fix(storage): use escapeshellarg for volume names in shell commands

Add proper shell escaping for persistent volume names when used in
docker volume rm commands. Also add volume name validation pattern
to ValidationPatterns for consistent input checking.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Andras Bacsai
2026-03-26 11:06:30 +01:00
co-authored by Claude Opus 4.6
parent d77e4c864f
commit d2064dd499
14 changed files with 149 additions and 13 deletions
+1 -1
View File
@@ -37,7 +37,7 @@ class ApplicationPreview extends BaseModel
$persistentStorages = $preview->persistentStorages()->get() ?? collect();
if ($persistentStorages->count() > 0) {
foreach ($persistentStorages as $storage) {
instant_remote_process(["docker volume rm -f $storage->name"], $server, false);
instant_remote_process(['docker volume rm -f '.escapeshellarg($storage->name)], $server, false);
}
}
}