3 Commits

Author	SHA1	Message	Date
Jose Diaz-Gonzalez	2df0791fcd	fix: prevent tar symlink traversal in archive extraction ... Archives passed to git:from-archive and certs:add were extracted without symlink or path validation, allowing a crafted archive to write arbitrary files anywhere writable by the dokku user via symlink traversal. Extraction now pre-scans entries for absolute paths, parent traversal, and unsafe symlinks, applies the GNU tar `--no-unsafe-links` flag when available, and validates symlinks after extraction.	2026-05-09 12:54:42 -04:00
Slava Shklyaev	fb405c64ab	Fix #6939	2025-07-23 14:46:21 -04:00
Jose Diaz-Gonzalez	db239debf1	feat: expose git-from-archive and git-from-image plugin triggers ... This will allow other plugins to create apps on the fly by specifying either an archive url or a docker image. Closes #4778	2021-09-22 12:32:17 -04:00