github/dokku
0
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Merge pull request #8591 from dokku/arbitrary-file-write

Browse Source 
Harden archive extraction against symlink traversal
This commit is contained in:
Jose Diaz-Gonzalez
2026-05-09 15:58:31 -04:00
committed by GitHub
parent 33dd8005dd 9decf16ea1
commit e78d3bcc78
9 changed files with 511 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
docs/configuration/ssl.md
View File

@@ -41,6 +41,9 @@ dokku certs:add node-js-app < cert-key.tar
cat yourdomain_com.crt yourdomain_com.ca-bundle > server.crt
```
> [!NOTE]
> Archives passed to `certs:add` are validated before extraction to prevent path traversal and symlink escape attacks. Archives containing absolute paths, parent directory traversal entries, or symlinks pointing outside the extraction directory will be rejected.
#### SSL and Multiple Domains
When an SSL certificate is associated to an application, the certificate will be associated with _all_ domains currently associated with said application. Your certificate _should_ be associated with all of those domains, otherwise accessing the application will result in SSL errors. If you wish to remove one of the domains from the application, refer to the [domain configuration documentation](/docs/configuration/domains.md).

26
docs/deployment/methods/archive.md
View File

@@ -32,3 +32,29 @@ Finally, if the archive url is specified as `--`, the archive will be fetched fr
```shell
curl -sSL https://github.com/dokku/smoke-test-app/releases/download/2.0.0/smoke-test-app.tar | dokku git:from-archive node-js-app --
```
## Archive Safety
Archive contents are validated before extraction to prevent path traversal and symlink escape attacks. Archives containing absolute paths, parent directory traversal entries (`..`), or symlinks pointing outside the extraction directory are rejected.
The following limits can be configured via global git properties:
- `archive-max-size` - maximum archive size in bytes (default: `1073741824`, 1 GiB)
- `archive-max-files` - maximum number of entries in an archive (default: `10000`)
```shell
dokku git:set --global archive-max-size 2147483648
dokku git:set --global archive-max-files 20000
```
Unset a property to restore the default:
```shell
dokku git:set --global archive-max-size
```
The current values can be inspected via the global git report:
```shell
dokku git:report --global
```