Files
dokku/tests/unit/run_2.bats
Jose Diaz-Gonzalez 1a376c3622 fix: prevent command injection via docker options eval
Values supplied through docker options, `--ttl-seconds`, and `-e` flowed into a Bash `eval` during build, deploy, and run, letting a low-privileged user execute arbitrary commands on the host as the dokku user. These arguments are now tokenized and passed through to the container verbatim, without shell expansion. A one-time migration repairs stored labels whose backticks were saved with a stray backslash so Traefik-style rules stay valid on the next deploy.
2026-07-19 01:42:12 -04:00

199 lines
5.0 KiB
Bash

#!/usr/bin/env bats
load test_helper
setup() {
global_setup
create_app
}
teardown() {
destroy_app
global_teardown
}
@test "(run) run" {
run deploy_app
echo "output: $output"
echo "status: $status"
assert_success
run /bin/bash -c "dokku run $TEST_APP echo $TEST_APP"
echo "output: $output"
echo "status: $status"
assert_success
run /bin/bash -c "docker ps -a -f 'status=exited' --no-trunc=true | grep \"/exec echo $TEST_APP\""
echo "output: $output"
echo "status: $status"
assert_failure
}
@test "(run) run:detached" {
run deploy_app
echo "output: $output"
echo "status: $status"
assert_success
RANDOM_RUN_CID="$(dokku --label=com.dokku.test-label=value run:detached $TEST_APP sleep 300)"
run /bin/bash -c "docker inspect -f '{{ .State.Status }}' $RANDOM_RUN_CID"
echo "output: $output"
echo "status: $status"
assert_output "running"
run /bin/bash -c "docker inspect $RANDOM_RUN_CID --format '{{ index .Config.Labels \"com.dokku.test-label\" }}'"
echo "output: $output"
echo "status: $status"
assert_output "value"
run /bin/bash -c "docker stop $RANDOM_RUN_CID"
echo "output: $output"
echo "status: $status"
assert_success
run /bin/bash -c "dokku cleanup"
echo "output: $output"
echo "status: $status"
assert_success
sleep 5 # wait for dokku cleanup to happen in the background
}
@test "(run) run (with tty)" {
run deploy_app
echo "output: $output"
echo "status: $status"
assert_success
run /bin/bash -c "dokku run $TEST_APP ls /app/null"
echo "output: $output"
echo "status: $status"
assert_success
}
@test "(run) run (without tty)" {
run deploy_app
echo "output: $output"
echo "status: $status"
assert_success
run /bin/bash -c ": |dokku run $TEST_APP ls /app/null"
echo "output: $output"
echo "status: $status"
assert_success
}
@test "(run) run command from Procfile" {
run deploy_app
echo "output: $output"
echo "status: $status"
assert_success
run /bin/bash -c "dokku run $TEST_APP custom 'hi dokku' | tail -n 1"
echo "output: $output"
echo "status: $status"
assert_success
assert_output 'hi dokku'
}
@test "(run) list" {
run deploy_app
echo "output: $output"
echo "status: $status"
assert_success
run /bin/bash -c "dokku --quiet run:list $TEST_APP"
echo "output: $output"
echo "status: $status"
assert_success
run /bin/bash -c "dokku run:detached $TEST_APP sleep 300"
echo "output: $output"
echo "status: $status"
assert_success
run /bin/bash -c "dokku --quiet run:list $TEST_APP | wc -l"
echo "output: $output"
echo "status: $status"
assert_success
assert_output "1"
run /bin/bash -c "dokku run:list $TEST_APP --format json | jq '. | length'"
echo "output: $output"
echo "status: $status"
assert_success
assert_output "1"
run /bin/bash -c "dokku run:list --format json $TEST_APP | jq '. | length'"
echo "output: $output"
echo "status: $status"
assert_success
assert_output "1"
run /bin/bash -c "dokku run:detached $TEST_APP sleep 300"
echo "output: $output"
echo "status: $status"
assert_success
run /bin/bash -c "dokku --quiet run:list $TEST_APP | wc -l"
echo "output: $output"
echo "status: $status"
assert_success
assert_output "2"
run /bin/bash -c "dokku run:list $TEST_APP --format json | jq '. | length'"
echo "output: $output"
echo "status: $status"
assert_success
assert_output "2"
run /bin/bash -c "dokku run:list --format json $TEST_APP | jq '. | length'"
echo "output: $output"
echo "status: $status"
assert_success
assert_output "2"
}
@test "(run) docker-options and -e flags are not eval-injected" {
run deploy_app
echo "output: $output"
echo "status: $status"
assert_success
run /bin/bash -c "dokku docker-options:add $TEST_APP run '--label=com.dokku.test=safe'"
echo "output: $output"
echo "status: $status"
assert_success
run /bin/bash -c "dokku run --ttl-seconds=60 -e FOO=bar $TEST_APP env | grep -E '^FOO=bar'"
echo "output: $output"
echo "status: $status"
assert_success
run /bin/bash -c "dokku run -e 'X=\$(id)' $TEST_APP env"
echo "output: $output"
echo "status: $status"
assert_success
[[ "$output" == *'X=$(id)'* ]] || flunk "expected literal X=\$(id) in container env"
[[ "$output" != *"uid="* ]] || flunk "id command output leaked - env value was expanded"
}
@test "(run) --ttl-seconds rejects non-numeric input; docker-options stores it verbatim" {
run /bin/bash -c "dokku run --ttl-seconds '\$(id)' $TEST_APP echo hi"
echo "output: $output"
echo "status: $status"
assert_failure
[[ "$output" != *"uid="* ]] || flunk "id command output leaked - ttl value was expanded"
run /bin/bash -c "dokku docker-options:add $TEST_APP run '--label=x=\$(id)'"
echo "output: $output"
echo "status: $status"
assert_success
run /bin/bash -c "dokku docker-options:report $TEST_APP --docker-options-run"
echo "output: $output"
echo "status: $status"
[[ "$output" == *'x=$(id)'* ]] || flunk "expected literal x=\$(id) stored in docker options"
[[ "$output" != *"uid="* ]] || flunk "id command output leaked - docker option was expanded"
}