Andras BacsaiandClaude Opus 4.6 c9922c30c2 fix: add input validation for install/build/start command fields ...

Add shellSafeCommandRules() validation to install_command, build_command,
and start_command fields in both the Livewire UI and REST API layers.
These fields previously accepted arbitrary strings without validation,
unlike other shell-adjacent fields which already used this pattern.

Also adds comprehensive tests for rejection of dangerous input and
acceptance of legitimate build commands.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-03-28 12:28:29 +01:00

..

Actions

refactor: simplify remote process chain and harden ActivityMonitor

2026-03-26 13:26:16 +01:00

Console

feat(sync): sync install.sh, docker-compose, and env files to GitHub

2026-03-25 07:07:22 +01:00

Contracts

…

Data

refactor: simplify remote process chain and harden ActivityMonitor

2026-03-26 13:26:16 +01:00

Enums

…

Events

Make proxy restart run as background job to prevent localhost lockout

2025-12-03 10:30:12 +01:00

Exceptions

feat(api): Improve OpenAPI spec and add rate limit handling for Hetzner

2025-12-11 12:12:43 +01:00

Helpers

fix(ssh): handle chmod failures gracefully and simplify key management

2026-03-16 21:27:10 +01:00

Http

refactor: split invitation endpoint into GET (show) and POST (accept)

2026-03-26 14:30:27 +01:00

Jobs

fix(backup): use escapeshellarg for credentials in database backup commands

2026-03-25 23:43:57 +01:00

Listeners

fix(proxy): defer UI refresh until Traefik version check completes

2025-12-27 15:16:58 +01:00

Livewire

fix: add input validation for install/build/start command fields

2026-03-28 12:28:29 +01:00

Models

fix(storage): use escapeshellarg for volume names in shell commands

2026-03-26 11:06:30 +01:00

Notifications

Fix: Allow test emails to be sent to any email address

2025-12-12 11:12:19 +01:00

Policies

chore: prepare for PR

2026-02-25 11:18:46 +01:00

Providers

Remove webhook maintenance mode replay feature

2025-12-02 13:36:32 +01:00

Repositories

…

Rules

fix: add URL validation for GitHub source api_url and html_url fields

2026-03-26 13:45:33 +01:00

Services

refactor: remove verbose logging and use explicit exception types

2026-03-20 15:57:26 +01:00

Support

fix(storage): use escapeshellarg for volume names in shell commands

2026-03-26 11:06:30 +01:00

Traits

feat(deployment): add command_hidden flag to hide command text in logs

2026-03-25 16:48:49 +01:00

View/Components

feat: add availableSharedVariables method and enhance env-var-input component for better password handling

2025-11-27 10:23:46 +01:00