The_Great_Archive/dokploy
1
0
Fork 0
mirror of https://github.com/Dokploy/dokploy.git synced 2026-09-14 11:06:15 +05:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix: allow docker compose command chaining

Browse Source
This commit is contained in:
ews-pgasser 2026-08-06 15:13:27 +02:00
parent 53feb9dd5b
commit ac57e22b87
1 changed files with 19 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
packages/server/src/utils/builders/compose.ts
View File

@ -70,7 +70,8 @@ Compose Type: ${composeType} ✅`;
// Shell control characters that must never appear in a user-provided compose
// command: they would let it break out of the `docker ${command}` invocation
// into arbitrary host commands. A normal docker compose CLI line never needs them.
const UNSAFE_COMPOSE_COMMAND = /[;&|`$(){}<>\n\\]/;
// Removed '&' from the blocklist to allow '&&' chaining
const UNSAFE_COMPOSE_COMMAND = /[;|`$(){}<>\n\\]/;
const sanitizeCommand = (command: string) => {
const sanitizedCommand = command.trim();
@ -81,8 +82,24 @@ const sanitizeCommand = (command: string) => {
);
}
const parts = sanitizedCommand.split(/\s+/);
if (sanitizedCommand.includes("&")) {
// Block single '&' (e.g., backgrounding tasks) or malformed chains like '&&&'
if (/(?<!&)&(?!&)/.test(sanitizedCommand) || sanitizedCommand.includes("&&&")) {
throw new Error("Single '&' is not allowed. Use '&&' for chaining.");
}
// Split by '&&' and check that every chained command (skipping the first one) is safe
const chains = sanitizedCommand.split("&&").map((cmd) => cmd.trim());
const isSafeChain = chains.slice(1).every((cmd) =>
cmd.startsWith("docker compose ") || cmd.startsWith("docker-compose ")
);
if (!isSafeChain) {
throw new Error("Chained commands must strictly start with 'docker compose '");
}
}
const parts = sanitizedCommand.split(/\s+/);
const restCommand = parts.map((arg) => arg.replace(/^"(.*)"$/, "$1"));
return restCommand.join(" ");