github/dokku
0
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

fix: restrict app names to prevent command injection

Browse Source 
The previous app name validation regex permitted shell metacharacters such as `;`, `$`, backticks, `|`, and `&`. These names were embedded unquoted into the generated git pre-receive hook script, allowing an authenticated user to execute arbitrary commands as the dokku user simply by pushing to a remote with a crafted app name. App names are now restricted to lowercase alphanumerics, dots, and hyphens, and the hook script also quotes the app variable as a defense-in-depth measure.
This commit is contained in:
Jose Diaz-Gonzalez
2026-05-09 12:46:02 -04:00
parent d00aaf3ff3
commit 93f87a0f07
5 changed files with 85 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
plugins/common/functions
View File

@@ -222,10 +222,8 @@ fn-is-valid-app-name() {
declare desc="verify that the app name matches naming restrictions"
local APP="$1"
[[ -z "$APP" ]] && dokku_log_fail "Please specify an app to run the command on"
if [[ "$APP" =~ ^[a-z].* ]] || [[ "$APP" =~ ^[0-9].* ]]; then
if [[ ! $APP =~ [A-Z] ]] && [[ ! $APP =~ [:] ]] && [[ ! $APP =~ [_] ]]; then
return 0
fi
if [[ "$APP" =~ ^[a-z0-9][a-z0-9.-]*$ ]]; then
return 0
fi
return 1
@@ -235,10 +233,8 @@ fn-is-valid-app-name-old() {
declare desc="verify that the app name matches the old naming restrictions"
local APP="$1"
[[ -z "$APP" ]] && dokku_log_fail "Please specify an app to run the command on"
if [[ "$APP" =~ ^[a-z].* ]] || [[ "$APP" =~ ^[0-9].* ]]; then
if [[ ! $APP =~ [A-Z] ]] && [[ ! $APP =~ [:] ]]; then
return 0
fi
if [[ "$APP" =~ ^[a-z0-9][a-z0-9.-]*$ ]]; then
return 0
fi
return 1
@@ -265,7 +261,7 @@ is_valid_app_name() {
return
fi
dokku_log_fail "App name must begin with lowercase alphanumeric character, and cannot include uppercase characters, colons, or underscores"
dokku_log_fail "App name must begin with lowercase alphanumeric character, and may only contain lowercase alphanumerics, dots, and hyphens"
}
is_valid_app_name_old() {
@@ -276,7 +272,7 @@ is_valid_app_name_old() {
return
fi
dokku_log_fail "App name must begin with lowercase alphanumeric character, and cannot include uppercase characters, or colons"
dokku_log_fail "App name must begin with lowercase alphanumeric character, and may only contain lowercase alphanumerics, dots, and hyphens"
}
verify_app_name() {