mirror of
https://github.com/Dokploy/dokploy.git
synced 2026-09-13 18:46:20 +05:00
df2779eaeb
- cluster.removeWorker: input.nodeId (z.string(), no regex) was interpolated raw
into 'docker node update/rm ${nodeId}' — now shell-quoted.
- swarm image upload (getRegistryCommands): registryTag / imageName were
interpolated raw into 'docker tag'/'docker push' and an echo. registryTag is
built from username and imagePrefix, which have no schema regex, so it was
injectable — now shell-quoted. (The docker login already used
safeDockerLoginCommand, so credentials were already safe.)
- gpu-setup: nodeId (derived from 'docker info', not user input) escaped as
defense-in-depth.
Closes GHSA-4mfc-grxw-6858, GHSA-hfwh-69ch-gv47, GHSA-prwq-2mcm-mvhr
|
||
|---|---|---|
| .. | ||
| auth | ||
| constants | ||
| db | ||
| emails | ||
| lib | ||
| monitoring | ||
| services | ||
| setup | ||
| templates | ||
| types | ||
| utils | ||
| verification | ||
| wss | ||
| index.ts | ||