cb1f571eb4
This commit addresses a critical security issue where malicious Docker Compose
data was being saved to the database before validation occurred.
Problem:
- Service models were saved to database first
- Validation ran afterwards during parse()
- Malicious data persisted even when validation failed
- User saw error but damage was already done
Solution:
1. Created validateDockerComposeForInjection() to validate YAML before save
2. Added pre-save validation to all Service creation/update points:
- Livewire: DockerCompose.php, StackForm.php
- API: ServicesController.php (create, update, one-click)
3. Validates service names and volume paths (string + array formats)
4. Blocks shell metacharacters: backticks, $(), |, ;, &, >, <, newlines
Security fixes:
- Volume source paths (string format) - validated before save
- Volume source paths (array format) - validated before save
- Service names - validated before save
- Environment variable patterns - safe ${VAR} allowed, ${VAR:-$(cmd)} blocked
Testing:
- 60 security tests pass (176 assertions)
- PreSaveValidationTest.php: 15 tests for pre-save validation
- ValidateShellSafePathTest.php: 15 tests for core validation
- VolumeSecurityTest.php: 15 tests for volume parsing
- ServiceNameSecurityTest.php: 15 tests for service names
Related commits:
- Previous: Added validation during parse() phase
- This commit: Moves validation before database save
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
86 lines
3 KiB
PHP
86 lines
3 KiB
PHP
<?php
|
|
|
|
namespace App\Livewire\Project\New;
|
|
|
|
use App\Models\EnvironmentVariable;
|
|
use App\Models\Project;
|
|
use App\Models\Service;
|
|
use App\Models\StandaloneDocker;
|
|
use App\Models\SwarmDocker;
|
|
use Livewire\Component;
|
|
use Symfony\Component\Yaml\Yaml;
|
|
|
|
class DockerCompose extends Component
|
|
{
|
|
public string $dockerComposeRaw = '';
|
|
|
|
public string $envFile = '';
|
|
|
|
public array $parameters;
|
|
|
|
public array $query;
|
|
|
|
public function mount()
|
|
{
|
|
$this->parameters = get_route_parameters();
|
|
$this->query = request()->query();
|
|
if (isDev()) {
|
|
$this->dockerComposeRaw = file_get_contents(base_path('templates/test-database-detection.yaml'));
|
|
}
|
|
}
|
|
|
|
public function submit()
|
|
{
|
|
$server_id = $this->query['server_id'];
|
|
try {
|
|
$this->validate([
|
|
'dockerComposeRaw' => 'required',
|
|
]);
|
|
$this->dockerComposeRaw = Yaml::dump(Yaml::parse($this->dockerComposeRaw), 10, 2, Yaml::DUMP_MULTI_LINE_LITERAL_BLOCK);
|
|
|
|
// Validate for command injection BEFORE saving to database
|
|
validateDockerComposeForInjection($this->dockerComposeRaw);
|
|
|
|
$project = Project::where('uuid', $this->parameters['project_uuid'])->first();
|
|
$environment = $project->load(['environments'])->environments->where('uuid', $this->parameters['environment_uuid'])->first();
|
|
|
|
$destination_uuid = $this->query['destination'];
|
|
$destination = StandaloneDocker::where('uuid', $destination_uuid)->first();
|
|
if (! $destination) {
|
|
$destination = SwarmDocker::where('uuid', $destination_uuid)->first();
|
|
}
|
|
if (! $destination) {
|
|
throw new \Exception('Destination not found. What?!');
|
|
}
|
|
$destination_class = $destination->getMorphClass();
|
|
|
|
$service = Service::create([
|
|
'docker_compose_raw' => $this->dockerComposeRaw,
|
|
'environment_id' => $environment->id,
|
|
'server_id' => (int) $server_id,
|
|
'destination_id' => $destination->id,
|
|
'destination_type' => $destination_class,
|
|
]);
|
|
|
|
$variables = parseEnvFormatToArray($this->envFile);
|
|
foreach ($variables as $key => $variable) {
|
|
EnvironmentVariable::create([
|
|
'key' => $key,
|
|
'value' => $variable,
|
|
'is_preview' => false,
|
|
'resourceable_id' => $service->id,
|
|
'resourceable_type' => $service->getMorphClass(),
|
|
]);
|
|
}
|
|
$service->parse(isNew: true);
|
|
|
|
return redirect()->route('project.service.configuration', [
|
|
'service_uuid' => $service->uuid,
|
|
'environment_uuid' => $environment->uuid,
|
|
'project_uuid' => $project->uuid,
|
|
]);
|
|
} catch (\Throwable $e) {
|
|
return handleError($e, $this);
|
|
}
|
|
}
|
|
}
|