rosslh/coolify
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
coolify/app
History
Andras Bacsai c9922c30c2 fix: add input validation for install/build/start command fields 
Add shellSafeCommandRules() validation to install_command, build_command,
and start_command fields in both the Livewire UI and REST API layers.
These fields previously accepted arbitrary strings without validation,
unlike other shell-adjacent fields which already used this pattern.

Also adds comprehensive tests for rejection of dangerous input and
acceptance of legitimate build commands.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-28 12:28:29 +01:00
..
Actions refactor: simplify remote process chain and harden ActivityMonitor 2026-03-26 13:26:16 +01:00
Console feat(sync): sync install.sh, docker-compose, and env files to GitHub 2026-03-25 07:07:22 +01:00
Contracts
Data refactor: simplify remote process chain and harden ActivityMonitor 2026-03-26 13:26:16 +01:00
Enums
Events Make proxy restart run as background job to prevent localhost lockout 2025-12-03 10:30:12 +01:00
Exceptions feat(api): Improve OpenAPI spec and add rate limit handling for Hetzner 2025-12-11 12:12:43 +01:00
Helpers fix(ssh): handle chmod failures gracefully and simplify key management 2026-03-16 21:27:10 +01:00
Http refactor: split invitation endpoint into GET (show) and POST (accept) 2026-03-26 14:30:27 +01:00
Jobs fix(backup): use escapeshellarg for credentials in database backup commands 2026-03-25 23:43:57 +01:00
Listeners fix(proxy): defer UI refresh until Traefik version check completes 2025-12-27 15:16:58 +01:00
Livewire fix: add input validation for install/build/start command fields 2026-03-28 12:28:29 +01:00
Models fix(storage): use escapeshellarg for volume names in shell commands 2026-03-26 11:06:30 +01:00
Notifications Fix: Allow test emails to be sent to any email address 2025-12-12 11:12:19 +01:00
Policies chore: prepare for PR 2026-02-25 11:18:46 +01:00
Providers Remove webhook maintenance mode replay feature 2025-12-02 13:36:32 +01:00
Repositories
Rules fix: add URL validation for GitHub source api_url and html_url fields 2026-03-26 13:45:33 +01:00
Services refactor: remove verbose logging and use explicit exception types 2026-03-20 15:57:26 +01:00
Support fix(storage): use escapeshellarg for volume names in shell commands 2026-03-26 11:06:30 +01:00
Traits feat(deployment): add command_hidden flag to hide command text in logs 2026-03-25 16:48:49 +01:00
View/Components feat: add availableSharedVariables method and enhance env-var-input component for better password handling 2025-11-27 10:23:46 +01:00