coolify/tests/Feature
Andras Bacsai 817128c5af refactor(validation): tokenize shell-safe command pattern
Replace the flat character-class regex for SHELL_SAFE_COMMAND_PATTERN with
a token-aware alternation. The parser now recognizes explicit tokens
(`&&`, `||`, balanced single/double quotes, whitespace, and an unquoted
safe-char run) instead of a bag of characters, which lets us extend the
accepted grammar without loosening the guarantees.

New surface area, with tests:
- logical OR chaining (`make build || make clean`)
- shell globs and bang (`rm *.tmp`, `cp src/?.js dist/`, `! grep -q foo`)
- single-quoted arguments are now treated as balanced runs rather than
  rejected per-character

Preserved surface area:
- && chaining, balanced "..." and '...' quotes, the previous safe path /
  argument characters, and the existing error-path contract in
  ApplicationDeploymentJob::validateShellSafeCommand().

Also refreshes the user-facing validation messages in General.php so the
allow/deny list shown on failure matches the new grammar.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-20 22:00:41 +02:00
..
Proxy
Service
Subscription feat(subscription): add billing interval to price preview 2026-03-27 19:05:13 +01:00
Webhook refactor(webhook): encrypt manual webhook secrets and tighten HMAC verification 2026-04-19 12:52:23 +02:00
ActivityMonitorCrossTeamTest.php refactor: simplify remote process chain and harden ActivityMonitor 2026-03-26 13:26:16 +01:00
AdminAccessAuthorizationTest.php refactor(admin): use named routes for admin index navigation 2026-04-19 11:58:52 +02:00
ApiTokenExpirationTest.php feat(security): support expiration on API tokens with warning notifications 2026-04-20 14:28:38 +02:00
ApiTokenExpirationWarningTest.php feat(security): support expiration on API tokens with warning notifications 2026-04-20 14:28:38 +02:00
ApiTokenPermissionTest.php fix(api): require write permission for validation endpoints 2026-03-10 22:11:52 +01:00
ApplicationBuildpackCleanupTest.php
ApplicationHealthCheckApiTest.php fix(models): replace forceFill/forceCreate with fill/create and add fillable guards 2026-03-31 13:45:31 +02:00
ApplicationPreviewApiTest.php feat(applications): add DELETE endpoint for preview deployments by PR id 2026-04-17 13:29:11 +02:00
ApplicationRedirectTest.php fix(application): persist redirect value in setRedirect 2026-03-29 20:50:03 +02:00
ApplicationRollbackTest.php fix(models): replace forceFill/forceCreate with fill/create and add fillable guards 2026-03-31 13:45:31 +02:00
ApplicationSourceLocalhostKeyTest.php fix(application-source): support localhost key with id=0 2026-03-09 17:20:33 +01:00
BackupRetentionAndStaleDetectionTest.php fix(backups): enforce retention and clean up stale executions 2026-04-03 11:33:21 +02:00
BreadcrumbsVisibilityTest.php fix(ui): improve responsive project headings and controls 2026-04-09 19:51:31 +02:00
BuildpackSwitchCleanupTest.php
CaCertificateCommandInjectionTest.php chore: prepare for PR 2026-02-25 12:00:24 +01:00
CheckTraefikVersionJobTest.php
CleanupRedisTest.php
CleanupUnreachableServersTest.php fix(team): mark servers unreachable when subscription ends 2026-04-15 15:12:29 +02:00
CleanupUnsubscribedServersTest.php fix(team): mark servers unreachable when subscription ends 2026-04-15 15:12:29 +02:00
ClonePersistentVolumeUuidTest.php fix(models): replace forceFill/forceCreate with fill/create and add fillable guards 2026-03-31 13:45:31 +02:00
CloudInitScriptTest.php
CloudProviderTokenApiTest.php feat(api): Improve OpenAPI spec and add rate limit handling for Hetzner 2025-12-11 12:12:43 +01:00
CmdHealthCheckValidationTest.php fix(health-checks): sanitize and validate CMD healthcheck commands 2026-02-25 11:28:33 +01:00
CommandInjectionSecurityTest.php refactor(validation): tokenize shell-safe command pattern 2026-04-20 22:00:41 +02:00
ComposePreviewFqdnTest.php fix(models): replace forceFill/forceCreate with fill/create and add fillable guards 2026-03-31 13:45:31 +02:00
ConvertArraysTest.php
ConvertContainerEnvsToArray.php
ConvertingGitUrlsTest.php fix(git): harden ssh URL normalization 2026-04-07 22:41:15 -05:00
CoolifyTaskRetryTest.php
CrossTeamIdorLogsTest.php Squashed commit from '565g-9j4m-wqmr-cross-team-idor-logs-fix' 2026-03-10 22:11:52 +01:00
CrossTeamIdorServerProjectTest.php test: remove GHSA advisory IDs from test descriptions and comments 2026-04-20 12:07:42 +02:00
DatabaseBackupCreationApiTest.php fix(api): use explicit team ID for S3 storage lookup in backup endpoints 2026-04-19 15:26:47 +02:00
DatabaseBackupJobTest.php fix(backup): prevent notification failures from affecting backup status 2026-03-25 12:43:47 +01:00
DatabaseBackupUploadValidationTest.php refactor(backup): validate database backup upload file type and size 2026-04-20 11:45:00 +02:00
DatabaseEnvironmentVariableApiTest.php fix(models): replace forceFill/forceCreate with fill/create and add fillable guards 2026-03-31 13:45:31 +02:00
DatabaseImportCommandInjectionTest.php fix(livewire): add Locked attributes and consolidate container name validation 2026-03-25 20:21:39 +01:00
DatabasePublicPortTimeoutApiTest.php fix(models): replace forceFill/forceCreate with fill/create and add fillable guards 2026-03-31 13:45:31 +02:00
DatabaseSslStatusRefreshTest.php fix(models): replace forceFill/forceCreate with fill/create and add fillable guards 2026-03-31 13:45:31 +02:00
DeletesUserSessionsTest.php
DeploymentByUuidApiTest.php fix(api): cast teamId to int in deployment authorization check 2026-03-12 13:25:10 +01:00
DeploymentCancellationApiTest.php
DeploymentCommandContainerResolutionTest.php refactor(jobs): extract container resolution logic for deployment commands 2026-03-25 14:09:07 +01:00
DeploymentLogsLayoutTest.php fix(deployments): use full-height deployment logs layout 2026-04-09 19:27:19 +02:00
DevHelperVersionValidationTest.php refactor(settings): validate dev_helper_version and escape build args 2026-04-20 11:51:27 +02:00
DockerCleanupJobTest.php feat(deployments): support Docker image tags for preview deployments 2026-03-30 13:35:35 +02:00
DockerCustomCommandsTest.php chore: prepare for PR 2026-03-01 18:49:40 +01:00
DockerImagePreviewDeploymentApiTest.php feat(deployments): support Docker image tags for preview deployments 2026-03-30 13:35:35 +02:00
DomainsByServerApiTest.php fix(api): validate server ownership in domains endpoint and scope activity lookups 2026-03-25 16:20:53 +01:00
EmailChangeVerificationTest.php refactor: use random_int() for email change verification codes 2026-03-28 12:25:54 +01:00
EmailVerificationHashTest.php refactor(auth): upgrade email verification hash to sha256 2026-04-20 12:09:48 +02:00
EnvironmentVariableBulkCommentApiTest.php feat(api): support comments in bulk environment variable endpoints 2026-03-19 22:17:55 +01:00
EnvironmentVariableCommentTest.php fix: update success message logic to only show when changes are made 2025-12-27 15:24:09 +01:00
EnvironmentVariableMassAssignmentTest.php refactor: add explicit fillable array to EnvironmentVariable model 2025-12-27 15:24:09 +01:00
EnvironmentVariableMultilineToggleViewTest.php fix(project): handle slash branches in public repo URLs 2026-04-01 09:11:56 +02:00
EnvironmentVariableSharedSpacingTest.php
EnvironmentVariableUpdateApiTest.php fix(api): extract resource UUIDs from route parameters 2026-03-19 21:56:58 +01:00
ExecuteContainerCommandTest.php
FeedbackEndpointTest.php refactor(api): validate and throttle feedback endpoint 2026-04-19 14:41:47 +02:00
GenerateApplicationNameTest.php feat(storage): add storage endpoints and UUID support for databases and services 2026-03-23 15:15:02 +01:00
GetLogsCommandInjectionTest.php fix(models): replace forceFill/forceCreate with fill/create and add fillable guards 2026-03-31 13:45:31 +02:00
GithubAppsListApiTest.php
GithubPrivateRepositoryTest.php fix(models): replace forceFill/forceCreate with fill/create and add fillable guards 2026-03-31 13:45:31 +02:00
GithubSourceChangeTest.php
GithubSourceCreateTest.php
GithubWebhookTest.php fix(github-webhook): handle unsupported event types gracefully 2026-03-23 21:33:40 +01:00
HetznerApiTest.php test: remove GHSA advisory IDs from test descriptions and comments 2026-04-20 12:07:42 +02:00
HetznerServerCreationTest.php
InternalModelCreationMassAssignmentTest.php fix(models): replace forceFill/forceCreate with fill/create and add fillable guards 2026-03-31 13:45:31 +02:00
IpAllowlistTest.php chore: prepare for PR 2026-03-03 16:43:29 +01:00
LinkLoginEmailVerificationTest.php refactor(auth): drop implicit email verification on invitation link login 2026-04-20 12:09:48 +02:00
LogFontStylingTest.php fix(database): refresh SSL/status state and harden clone writes 2026-03-31 09:29:36 +02:00
LoginRateLimitIPTest.php
MassAssignmentProtectionTest.php refactor(models): add fillable attributes for database configuration options 2026-03-30 08:11:23 +02:00
ModelFillableCreationTest.php fix(models): replace forceFill/forceCreate with fill/create and add fillable guards 2026-03-31 13:45:31 +02:00
MultilineEnvironmentVariableTest.php chore: prepare for PR 2026-02-23 14:28:28 +01:00
PasswordVisibilityComponentTest.php feat(forms): make textarea monospace opt-in and improve multiline toggle 2026-03-31 15:37:42 +02:00
PreviewEnvVarFallbackTest.php feat(preview-env): add production variable fallback for docker-compose 2026-03-25 13:26:50 +01:00
PublicGitRepositoryBranchParsingTest.php fix(project): handle slash branches in public repo URLs 2026-04-01 09:11:56 +02:00
PushServerUpdateJobLastOnlineTest.php chore: prepare for PR 2026-03-10 18:34:37 +01:00
PushServerUpdateJobOptimizationTest.php feat(jobs): optimize async job dispatches and enhance Stripe subscription sync 2026-02-28 13:18:44 +01:00
PushServerUpdateJobTest.php chore: prepare for PR 2026-02-15 13:43:08 +01:00
RealtimeTerminalPackagingTest.php chore: prepare for PR 2026-03-10 20:37:22 +01:00
ResetPasswordUrlTest.php refactor: simplify TrustHosts middleware and use APP_URL as base_url fallback 2026-03-28 12:12:48 +01:00
ResourceOperationsCrossTenantTest.php chore: prepare for PR 2026-02-25 11:18:46 +01:00
ResponsiveCheckboxLayoutTest.php fix(ui): improve responsive project headings and controls 2026-04-09 19:51:31 +02:00
ScheduledJobManagerShouldRunNowTest.php refactor(scheduler): extract cron scheduling logic to shared helper 2026-03-23 10:37:49 +01:00
ScheduledJobManagerStaleLockTest.php chore: prepare for PR 2026-02-25 12:07:29 +01:00
ScheduledJobMonitoringTest.php fix(jobs): prevent non-due jobs firing on restart and enrich skip logs with resource links 2026-02-28 18:03:29 +01:00
ScheduledLogsCommandInputTest.php refactor(cli): validate --date and escape shell args on logs:scheduled 2026-04-20 12:09:48 +02:00
ScheduledTaskApiTest.php test(factories): add missing model factories for app test suite 2026-03-03 09:50:05 +01:00
SecureCookieAutoDetectionTest.php fix(subscription): harden quantity updates and proxy trust behavior 2026-03-03 12:28:16 +01:00
SentinelTokenValidationTest.php fix(sentinel): add token validation to prevent command injection 2026-03-10 22:19:19 +01:00
SentinelUpdateCheckIndependenceTest.php
ServerIpUniquenessTest.php fix(server): improve IP uniqueness validation with team-specific error messages 2026-02-12 08:10:59 +01:00
ServerLimitCheckJobTest.php fix(server-limit): re-enable force-disabled servers at limit 2026-03-03 17:03:59 +01:00
ServerManagerJobShouldRunNowTest.php refactor(scheduler): extract cron scheduling logic to shared helper 2026-03-23 10:37:49 +01:00
ServerMetadataTest.php feat(server): auto-fetch server metadata after validation 2026-03-13 17:07:50 +01:00
ServerPatchCheckNotificationTest.php
ServerSettingSentinelRestartTest.php
ServerSettingWasChangedTest.php
ServerStorageCheckIndependenceTest.php
ServerValidationXssTest.php fix: sanitize error output in server validation logs 2026-03-26 18:36:36 +01:00
ServiceContainerLabelEscapeApiTest.php feat(service): add container label escape control to services API 2026-03-13 13:32:58 +01:00
ServiceDatabaseTeamTest.php fix(models): replace forceFill/forceCreate with fill/create and add fillable guards 2026-03-31 13:45:31 +02:00
ServiceFqdnUpdatePathTest.php
ServiceMagicVariableOverwriteTest.php test(magic-variables): add feature tests for SERVICE_URL/FQDN variable handling 2026-03-11 17:15:17 +01:00
SettingsUpdatesAuthorizationTest.php fix(settings): require instance admin authorization for updates page 2026-03-25 19:33:51 +01:00
SharedVariableComposeResolutionTest.php fix(parsers): resolve shared variables in compose environment 2026-03-12 13:23:13 +01:00
SharedVariableDevViewTest.php fix(shared-variables): support direct mount params and comment field for server variables 2026-03-31 14:58:01 +02:00
SslCertificateRegenerationTest.php fix(database): auto-generate missing CA cert on SSL regeneration 2026-03-30 13:10:49 +02:00
StartDatabaseProxyTest.php fix(proxy): add validation and normalization for database proxy timeout 2026-03-10 09:59:19 +01:00
StartupExecutionCleanupTest.php
StorageApiTest.php fix(models): replace forceFill/forceCreate with fill/create and add fillable guards 2026-03-31 13:45:31 +02:00
TeamInvitationCsrfProtectionTest.php refactor: split invitation endpoint into GET (show) and POST (accept) 2026-03-26 14:30:27 +01:00
TeamInvitationEmailNormalizationTest.php
TeamInvitationPrivilegeEscalationTest.php
TeamNotificationCheckTest.php chore: prepare for PR 2026-02-23 13:02:06 +01:00
TeamPolicyTest.php
TeamScopedBackupStorageTest.php refactor: scope destination and resource lookups by current team 2026-04-19 11:55:12 +02:00
TeamScopedDestinationTest.php refactor: scope destination and resource lookups by current team 2026-04-19 11:55:12 +02:00
TeamScopedResourceProofsTest.php refactor: scope destination and resource lookups by current team 2026-04-19 11:55:12 +02:00
TeamServerLimitTest.php refactor(team): make server limit methods accept optional team parameter 2026-03-23 21:56:50 +01:00
TerminalAuthIpsRouteTest.php chore: prepare for PR 2026-03-10 20:37:22 +01:00
TerminalAuthRoutesAuthorizationTest.php fix(terminal): apply authorization middleware to terminal bootstrap routes 2026-03-25 16:56:37 +01:00
TwoFactorChallengeAccessTest.php chore: prepare for PR 2026-02-24 10:17:16 +01:00
UpgradeComponentTest.php fix(upgrade): clear stale upgrade flag when version is already current 2026-04-09 14:31:12 +02:00
UserDeletionWithGithubAppTest.php fix(team): transfer instance-wide sources to root team on deletion 2026-04-09 14:51:52 +02:00
Utf8HandlingTest.php