mirror of
https://github.com/dokku/dokku.git
synced 2026-08-29 10:08:53 +02:00
1a376c3622
Values supplied through docker options, `--ttl-seconds`, and `-e` flowed into a Bash `eval` during build, deploy, and run, letting a low-privileged user execute arbitrary commands on the host as the dokku user. These arguments are now tokenized and passed through to the container verbatim, without shell expansion. A one-time migration repairs stored labels whose backticks were saved with a stray backslash so Traefik-style rules stay valid on the next deploy.
264 lines
7.2 KiB
Bash
264 lines
7.2 KiB
Bash
#!/usr/bin/env bats
|
|
|
|
load test_helper
|
|
|
|
setup() {
|
|
create_app
|
|
}
|
|
|
|
teardown() {
|
|
destroy_app
|
|
}
|
|
|
|
@test "(builder-herokuish:report) info-flag works before deploy" {
|
|
run /bin/bash -c "dokku builder-herokuish:report $TEST_APP --builder-herokuish-allowed"
|
|
echo "output: $output"
|
|
echo "status: $status"
|
|
assert_success
|
|
|
|
run /bin/bash -c "dokku builder-herokuish:set $TEST_APP allowed false"
|
|
echo "output: $output"
|
|
echo "status: $status"
|
|
assert_success
|
|
|
|
run /bin/bash -c "dokku builder-herokuish:report $TEST_APP --builder-herokuish-allowed"
|
|
echo "output: $output"
|
|
echo "status: $status"
|
|
assert_success
|
|
assert_output "false"
|
|
|
|
run /bin/bash -c "dokku builder-herokuish:report $TEST_APP --builder-herokuish-invalid-flag"
|
|
echo "output: $output"
|
|
echo "status: $status"
|
|
assert_failure
|
|
assert_output_contains "Invalid flag passed"
|
|
}
|
|
|
|
@test "(builder-herokuish:report) --global --builder-herokuish-global-allowed" {
|
|
run /bin/bash -c "dokku builder-herokuish:set --global allowed false"
|
|
echo "output: $output"
|
|
echo "status: $status"
|
|
assert_success
|
|
|
|
run /bin/bash -c "dokku builder-herokuish:report --global --builder-herokuish-global-allowed"
|
|
echo "output: $output"
|
|
echo "status: $status"
|
|
assert_success
|
|
assert_output "false"
|
|
|
|
run /bin/bash -c "dokku builder-herokuish:set --global allowed"
|
|
echo "output: $output"
|
|
echo "status: $status"
|
|
assert_success
|
|
}
|
|
|
|
@test "(builder-herokuish:report) allowed raw vs computed vs global" {
|
|
local default_allowed="true"
|
|
[[ "$(dpkg --print-architecture 2>/dev/null || true)" != "amd64" ]] && default_allowed="false"
|
|
|
|
run /bin/bash -c "dokku builder-herokuish:set --global allowed"
|
|
assert_success
|
|
|
|
run /bin/bash -c "dokku builder-herokuish:report $TEST_APP --builder-herokuish-allowed"
|
|
assert_success
|
|
assert_output_not_exists
|
|
|
|
run /bin/bash -c "dokku builder-herokuish:report $TEST_APP --builder-herokuish-global-allowed"
|
|
assert_success
|
|
assert_output_not_exists
|
|
|
|
run /bin/bash -c "dokku builder-herokuish:report $TEST_APP --builder-herokuish-computed-allowed"
|
|
assert_success
|
|
assert_output "$default_allowed"
|
|
|
|
run /bin/bash -c "dokku builder-herokuish:set --global allowed false"
|
|
assert_success
|
|
|
|
run /bin/bash -c "dokku builder-herokuish:report $TEST_APP --builder-herokuish-global-allowed"
|
|
assert_success
|
|
assert_output "false"
|
|
|
|
run /bin/bash -c "dokku builder-herokuish:report $TEST_APP --builder-herokuish-computed-allowed"
|
|
assert_success
|
|
assert_output "false"
|
|
|
|
run /bin/bash -c "dokku builder-herokuish:set $TEST_APP allowed true"
|
|
assert_success
|
|
|
|
run /bin/bash -c "dokku builder-herokuish:report $TEST_APP --builder-herokuish-allowed"
|
|
assert_success
|
|
assert_output "true"
|
|
|
|
run /bin/bash -c "dokku builder-herokuish:report $TEST_APP --builder-herokuish-global-allowed"
|
|
assert_success
|
|
assert_output "false"
|
|
|
|
run /bin/bash -c "dokku builder-herokuish:report $TEST_APP --builder-herokuish-computed-allowed"
|
|
assert_success
|
|
assert_output "true"
|
|
|
|
run /bin/bash -c "dokku builder-herokuish:set $TEST_APP allowed"
|
|
assert_success
|
|
|
|
run /bin/bash -c "dokku builder-herokuish:set --global allowed"
|
|
assert_success
|
|
}
|
|
|
|
@test "(builder-herouish:build .env)" {
|
|
run /bin/bash -c "dokku docker-options:add $TEST_APP build '--label=com.dokku.build-test=safe'"
|
|
echo "output: $output"
|
|
echo "status: $status"
|
|
assert_success
|
|
|
|
run deploy_app python dokku@$DOKKU_DOMAIN:$TEST_APP
|
|
echo "output: $output"
|
|
echo "status: $status"
|
|
assert_success
|
|
assert_output_contains 'DOTENV_KEY=some_value'
|
|
}
|
|
|
|
@test "(builder-herokuish) builder-herokuish:set allowed" {
|
|
if [[ "$(dpkg --print-architecture 2>/dev/null || true)" == "amd64" ]]; then
|
|
skip "this test cannot be performed accurately on amd64 as it tests whether we can enable the plugin on arm64"
|
|
fi
|
|
|
|
run /bin/bash -c "dokku builder-herokuish:set --global allowed"
|
|
echo "output: $output"
|
|
echo "status: $status"
|
|
assert_success
|
|
|
|
run /bin/bash -c "dokku builder-herokuish:report $TEST_APP"
|
|
echo "output: $output"
|
|
echo "status: $status"
|
|
assert_success
|
|
|
|
run deploy_app
|
|
echo "output: $output"
|
|
echo "status: $status"
|
|
assert_failure
|
|
|
|
run create_app
|
|
echo "output: $output"
|
|
echo "status: $status"
|
|
assert_success
|
|
|
|
run /bin/bash -c "dokku builder-herokuish:set --global allowed true"
|
|
echo "output: $output"
|
|
echo "status: $status"
|
|
assert_success
|
|
|
|
run /bin/bash -c "dokku builder-herokuish:report $TEST_APP"
|
|
echo "output: $output"
|
|
echo "status: $status"
|
|
assert_success
|
|
|
|
run deploy_app
|
|
echo "output: $output"
|
|
echo "status: $status"
|
|
assert_success
|
|
|
|
run /bin/bash -c "dokku builder-herokuish:set --global allowed"
|
|
echo "output: $output"
|
|
echo "status: $status"
|
|
assert_success
|
|
|
|
run /bin/bash -c "dokku builder-herokuish:set $TEST_APP allowed true"
|
|
echo "output: $output"
|
|
echo "status: $status"
|
|
assert_success
|
|
|
|
run /bin/bash -c "dokku builder-herokuish:report $TEST_APP"
|
|
echo "output: $output"
|
|
echo "status: $status"
|
|
assert_success
|
|
|
|
run /bin/bash -c "dokku ps:rebuild $TEST_APP"
|
|
echo "output: $output"
|
|
echo "status: $status"
|
|
assert_success
|
|
|
|
run /bin/bash -c "dokku builder-herokuish:set $TEST_APP allowed"
|
|
echo "output: $output"
|
|
echo "status: $status"
|
|
assert_success
|
|
|
|
run /bin/bash -c "dokku ps:rebuild $TEST_APP"
|
|
echo "output: $output"
|
|
echo "status: $status"
|
|
assert_failure
|
|
}
|
|
|
|
@test "(builder-herokuish) run" {
|
|
run /bin/bash -c "dokku config:set $TEST_APP SECRET_KEY=fjdkslafjdk"
|
|
echo "output: $output"
|
|
echo "status: $status"
|
|
assert_success
|
|
|
|
run /bin/bash -c "dokku builder:set $TEST_APP selected herokuish"
|
|
echo "output: $output"
|
|
echo "status: $status"
|
|
assert_success
|
|
|
|
run deploy_app python dokku@$DOKKU_DOMAIN:$TEST_APP
|
|
echo "output: $output"
|
|
echo "status: $status"
|
|
assert_success
|
|
|
|
run /bin/bash -c "dokku run $TEST_APP python3 task.py test"
|
|
echo "output: $output"
|
|
echo "status: $status"
|
|
assert_success
|
|
assert_output "['task.py', 'test']"
|
|
|
|
run /bin/bash -c "dokku --quiet run $TEST_APP task"
|
|
echo "output: $output"
|
|
echo "status: $status"
|
|
assert_success
|
|
assert_output "['task.py', 'test']"
|
|
|
|
run /bin/bash -c "dokku run $TEST_APP env"
|
|
echo "output: $output"
|
|
echo "status: $status"
|
|
assert_success
|
|
assert_output_contains "SECRET_KEY=fjdkslafjdk"
|
|
}
|
|
|
|
@test "(builder-herokuish) cron:run" {
|
|
run /bin/bash -c "dokku config:set $TEST_APP SECRET_KEY=fjdkslafjdk"
|
|
echo "output: $output"
|
|
echo "status: $status"
|
|
assert_success
|
|
|
|
run /bin/bash -c "dokku builder:set $TEST_APP selected herokuish"
|
|
echo "output: $output"
|
|
echo "status: $status"
|
|
assert_success
|
|
|
|
run deploy_app python dokku@$DOKKU_DOMAIN:$TEST_APP cron_run_wrapper
|
|
echo "output: $output"
|
|
echo "status: $status"
|
|
assert_success
|
|
|
|
cron_id="$(dokku cron:list $TEST_APP --format json | jq -r '.[0].id')"
|
|
run /bin/bash -c "echo $cron_id"
|
|
echo "output: $output"
|
|
echo "status: $status"
|
|
assert_success
|
|
assert_output_exists
|
|
|
|
run /bin/bash -c "dokku cron:run $TEST_APP $cron_id"
|
|
echo "output: $output"
|
|
echo "status: $status"
|
|
assert_success
|
|
assert_output "['task.py', 'some', 'cron', 'task']"
|
|
}
|
|
|
|
cron_run_wrapper() {
|
|
local APP="$1"
|
|
local APP_REPO_DIR="$2"
|
|
[[ -z "$APP" ]] && local APP="$TEST_APP"
|
|
APP_REPO_DIR="$(realpath "$APP_REPO_DIR")"
|
|
|
|
mv -f "$APP_REPO_DIR/app-cron.json" "$APP_REPO_DIR/app.json"
|
|
}
|