The_Great_Archive/dokploy
1
0
Fork 0
mirror of https://github.com/Dokploy/dokploy.git synced 2026-09-14 11:06:15 +05:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix: reject unsafe restore path metacharacters

Browse Source
This commit is contained in:
Furox 2026-09-04 23:10:39 +03:00 committed by Furox88
parent 6faf01ec3c
commit 54893f0dee
1 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
packages/server/src/utils/volume-backups/restore.ts
View File

@ -8,15 +8,22 @@ import {
paths,
} from "../..";
const UNSAFE_BACKUP_PATH_CHARS = /[\0\r\n;&|`$<>]/;
export const normalizeVolumeBackupFilePath = (value: string) => {
const normalized = value.trim().replace(/\\/g, "/");
if (!normalized || normalized.startsWith("/") || normalized.endsWith("/")) {
if (
!normalized ||
normalized.startsWith("/") ||
normalized.endsWith("/") ||
UNSAFE_BACKUP_PATH_CHARS.test(normalized)
) {
throw new Error("Invalid volume backup file path");
}
const segments = normalized.split("/");
if (
segments.some(
(segment) => !segment || segment === "." || segment === ".." || segment.includes("\0"),
(segment) => !segment || segment === "." || segment === "..",
)
) {
throw new Error("Invalid volume backup file path");