mirror of
https://github.com/Dokploy/dokploy.git
synced 2026-09-13 18:46:20 +05:00
df2779eaeb
- cluster.removeWorker: input.nodeId (z.string(), no regex) was interpolated raw
into 'docker node update/rm ${nodeId}' — now shell-quoted.
- swarm image upload (getRegistryCommands): registryTag / imageName were
interpolated raw into 'docker tag'/'docker push' and an echo. registryTag is
built from username and imagePrefix, which have no schema regex, so it was
injectable — now shell-quoted. (The docker login already used
safeDockerLoginCommand, so credentials were already safe.)
- gpu-setup: nodeId (derived from 'docker info', not user input) escaped as
defense-in-depth.
Closes GHSA-4mfc-grxw-6858, GHSA-hfwh-69ch-gv47, GHSA-prwq-2mcm-mvhr
|
||
|---|---|---|
| .. | ||
| scripts | ||
| src | ||
| auth-schema2.ts | ||
| auth-schema.ts | ||
| esbuild.config.ts | ||
| package.json | ||
| tsconfig.json | ||
| tsconfig.server.json | ||
| tsconfig.server.no-decl.json | ||