mirror of
https://github.com/Dokploy/dokploy.git
synced 2026-09-13 18:46:20 +05:00
d48037a802
- composePath / appName are now passed through shell-quote in createCommand,
getCreateEnvFileCommand and services/compose.ts deploy commands, instead of
being interpolated raw into 'docker compose'/'docker stack' shell commands.
- compose.command: sanitizeCommand was cosmetic (trim + strip quotes). It now
rejects shell control characters (; & | ` $ () {} <> newline), which a normal
docker compose CLI line never contains, blocking breakout into host commands.
Closes GHSA-8r5w-vqjr-8c44, GHSA-5xv2-7f8w-9j5c, GHSA-qh6h-669j-77rw
|
||
|---|---|---|
| .. | ||
| scripts | ||
| src | ||
| auth-schema2.ts | ||
| auth-schema.ts | ||
| esbuild.config.ts | ||
| package.json | ||
| tsconfig.json | ||
| tsconfig.server.json | ||
| tsconfig.server.no-decl.json | ||