mirror of
https://github.com/Dokploy/dokploy.git
synced 2026-09-14 11:06:15 +05:00
d48037a802
- composePath / appName are now passed through shell-quote in createCommand,
getCreateEnvFileCommand and services/compose.ts deploy commands, instead of
being interpolated raw into 'docker compose'/'docker stack' shell commands.
- compose.command: sanitizeCommand was cosmetic (trim + strip quotes). It now
rejects shell control characters (; & | ` $ () {} <> newline), which a normal
docker compose CLI line never contains, blocking breakout into host commands.
Closes GHSA-8r5w-vqjr-8c44, GHSA-5xv2-7f8w-9j5c, GHSA-qh6h-669j-77rw
|
||
|---|---|---|
| .. | ||
| compose.ts | ||
| docker-file.ts | ||
| drop.ts | ||
| heroku.ts | ||
| index.ts | ||
| nixpacks.ts | ||
| paketo.ts | ||
| railpack.ts | ||
| static.ts | ||
| utils.ts | ||