The_Great_Archive/dokploy
1
0
Fork 0
mirror of https://github.com/Dokploy/dokploy.git synced 2026-09-13 18:46:20 +05:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge pull request #4875 from Dokploy/fix/cmdi-registry-test-login

Browse Source 
fix(security): command injection in registry.testRegistry / testRegistryById
This commit is contained in:
Mauricio Siu 2026-07-20 17:40:00 -06:00 committed by GitHub
commit ffe62bca0e
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
apps/dokploy/server/api/routers/registry.ts
View File

@ -5,6 +5,7 @@ import {
findRegistryById,
IS_CLOUD,
removeRegistry,
safeDockerLoginCommand,
updateRegistry,
} from "@dokploy/server";
import { db } from "@dokploy/server/db";
@ -122,7 +123,11 @@ export const registryRouter = createTRPCRouter({
if (input.serverId && input.serverId !== "none") {
await execAsyncRemote(
input.serverId,
`echo ${input.password} | docker ${args.join(" ")}`,
safeDockerLoginCommand(
input.registryUrl,
input.username,
input.password,
),
);
} else {
await execFileAsync("docker", args, {
@ -182,7 +187,11 @@ export const registryRouter = createTRPCRouter({
if (input.serverId && input.serverId !== "none") {
await execAsyncRemote(
input.serverId,
`echo ${registryData.password} | docker ${args.join(" ")}`,
safeDockerLoginCommand(
registryData.registryUrl,
registryData.username,
registryData.password,
),
);
} else {
await execFileAsync("docker", args, {