Mirrors/dokku
1
0
Fork 0
mirror of https://github.com/dokku/dokku.git synced 2026-08-29 10:08:53 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: prevent command injection via docker options eval

Browse Source 
Values supplied through docker options, `--ttl-seconds`, and `-e` flowed into a Bash `eval` during build, deploy, and run, letting a low-privileged user execute arbitrary commands on the host as the dokku user. These arguments are now tokenized and passed through to the container verbatim, without shell expansion. A one-time migration repairs stored labels whose backticks were saved with a stray backslash so Traefik-style rules stay valid on the next deploy.
This commit is contained in:
Jose Diaz-Gonzalez
2026-07-18 09:22:37 -04:00
parent 730fa85d03
commit 1a376c3622
25 changed files with 444 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
plugins/builder-herokuish/builder-build
View File

@@ -71,8 +71,10 @@ trigger-builder-herokuish-builder-build() {
fi
DOCKER_ARGS+=" $(: | plugn trigger docker-args-process-build "$APP" "$BUILDER_TYPE")"
declare -a ARG_ARRAY
eval "ARG_ARRAY=($DOCKER_ARGS)"
declare -a ARG_ARRAY=()
while IFS= read -r -d '' arg; do
ARG_ARRAY+=("$arg")
done < <(fn-docker-args-split "$DOCKER_ARGS")
local DOKKU_CONTAINER_EXIT_CODE=0
fn-builder-herokuish-ensure-cache "$APP"