tiennm99/coolify
1
0
Fork 0
mirror of https://github.com/tiennm99/coolify.git synced 2026-09-04 06:19:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(database): set PostgreSQL SSL certificate ownership (#11286)

Browse Source
This commit is contained in:
Andras Bacsai
2026-08-14 20:44:05 +02:00
committed by GitHub
parent b3789d4a36
commit 096a1f5f08
5 changed files with 38 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/Unit/DatabaseSslCredentialEscapingTest.php
+29
View File
@@ -21,6 +21,35 @@ it('escapeshellarg wraps postgres_user in single quotes for chown command', func
->toContain('chown');
});
it('sets postgres SSL file ownership before starting the database container', function () {
$source = file_get_contents(__DIR__.'/../../app/Actions/Database/StartPostgresql.php');
$permissionCommandPosition = strpos($source, '--entrypoint chown');
$startCommandPosition = strpos($source, 'docker-compose.yml up -d');
expect($permissionCommandPosition)->not->toBeFalse()
->and($startCommandPosition)->not->toBeFalse()
->and($permissionCommandPosition)->toBeLessThan($startCommandPosition)
->and($source)->toContain('postgres:postgres /var/lib/postgresql/certs/server.key')
->not->toContain('chown {$postgresUser}:{$postgresUser}');
});
it('sets database SSL file ownership before startup', function (string $action, string $owner, string $keyPath) {
$source = file_get_contents(__DIR__."/../../app/Actions/Database/{$action}.php");
$permissionCommandPosition = strpos($source, '--entrypoint chown');
$startCommandPosition = strpos($source, 'docker-compose.yml up -d');
expect($permissionCommandPosition)->not->toBeFalse()
->and($startCommandPosition)->not->toBeFalse()
->and($permissionCommandPosition)->toBeLessThan($startCommandPosition)
->and($source)->toContain("{$owner} {$keyPath}");
})->with([
'mysql' => ['StartMysql', 'mysql:mysql', '/etc/mysql/certs/server.key'],
'mariadb' => ['StartMariadb', 'mysql:mysql', '/etc/mysql/certs/server.key'],
'mongodb' => ['StartMongodb', 'mongodb:mongodb', '/etc/mongo/certs/server.pem'],
]);
it('advisory PoC postgres_user payload is contained by escapeshellarg in chown command', function () {
// Simulates a legacy row that bypassed validation
$maliciousUser = 'root; touch /tmp/pwned_rce; #';