From fba0681e5b4900e7b4269e5fb7764d75a3fa14b6 Mon Sep 17 00:00:00 2001
From: Jose Diaz-Gonzalez <email@josediazgonzalez.com>
Date: Sat, 26 Sep 2026 01:17:30 -0400
Subject: [PATCH] fix: avoid glob expansion of app domains

A catch-all `*` domain or a wildcard ssl hostname could be expanded into file names from the current directory when generating app urls, healthcheck `Host` headers, or the nginx ssl server names.
---
 plugins/domains/internal-functions          |  8 ++++---
 plugins/nginx-vhosts/functions              |  4 +++-
 plugins/scheduler-docker-local/check-deploy |  8 ++++---
 tests/unit/domains.bats                     | 25 +++++++++++++++++++++
 4 files changed, 38 insertions(+), 7 deletions(-)

diff --git a/plugins/domains/internal-functions b/plugins/domains/internal-functions
index 04f68bef6..dfcfbb77a 100644
--- a/plugins/domains/internal-functions
+++ b/plugins/domains/internal-functions
@@ -38,9 +38,11 @@ fn-domains-global-vhosts() {
 fn-domains-generate-urls() {
   declare APP="$1" DEFAULT_SCHEME="$2" DEFAULT_LISTEN_PORT="$3"
 
-  local app_vhosts="$(plugn trigger domains-list "$APP")"
-  if [[ -n "$app_vhosts" ]]; then
-    for app_vhost in $app_vhosts; do
+  local app_vhost
+  local -a app_vhosts
+  read -r -d '' -a app_vhosts <<<"$(plugn trigger domains-list "$APP")" || true
+  if [[ "${#app_vhosts[@]}" -gt 0 ]]; then
+    for app_vhost in "${app_vhosts[@]}"; do
       fn-domains-generate-urls-from-config "$APP" "$DEFAULT_SCHEME" "$app_vhost" "$DEFAULT_LISTEN_PORT"
     done
   else
diff --git a/plugins/nginx-vhosts/functions b/plugins/nginx-vhosts/functions
index 970f08062..d2a11212b 100755
--- a/plugins/nginx-vhosts/functions
+++ b/plugins/nginx-vhosts/functions
@@ -252,7 +252,9 @@ fn-nginx-vhosts-render-template() {
       SSL_VHOSTS=$(<"$DOKKU_ROOT/VHOST")
     fi
     local host
-    for host in $SSL_VHOSTS; do
+    local -a ssl_vhosts
+    read -r -d '' -a ssl_vhosts <<<"$SSL_VHOSTS" || true
+    for host in "${ssl_vhosts[@]}"; do
       if [[ ! $NOSSL_SERVER_NAME =~ (^|[[:space:]])$host($|[[:space:]]) ]]; then
         SSL_SERVER_NAME="${host}${SSL_SERVER_NAME:+ $SSL_SERVER_NAME}"
       fi
diff --git a/plugins/scheduler-docker-local/check-deploy b/plugins/scheduler-docker-local/check-deploy
index 8772aefd6..b9bdb1645 100755
--- a/plugins/scheduler-docker-local/check-deploy
+++ b/plugins/scheduler-docker-local/check-deploy
@@ -145,9 +145,11 @@ trigger-scheduler-docker-local-check-deploy() {
     ARG_ARRAY+=("$DOKKU_APP_LISTEN_PORT")
   fi
 
-  local app_vhosts="$(plugn trigger domains-list "$APP")"
-  if [[ -n "$app_vhosts" ]]; then
-    for app_vhost in $app_vhosts; do
+  local app_vhost
+  local -a app_vhosts
+  read -r -d '' -a app_vhosts <<<"$(plugn trigger domains-list "$APP")" || true
+  if [[ "${#app_vhosts[@]}" -gt 0 ]]; then
+    for app_vhost in "${app_vhosts[@]}"; do
       if [[ "$app_vhost" == "localhost" ]] || [[ "$app_vhost" == '*' ]]; then
         continue
       fi
diff --git a/tests/unit/domains.bats b/tests/unit/domains.bats
index bbf965fb2..6edd71f64 100644
--- a/tests/unit/domains.bats
+++ b/tests/unit/domains.bats
@@ -533,3 +533,28 @@ teardown() {
   assert_success
   assert_output "http:2019:2019 http:80:80 https:443:443 udp:443:443"
 }
+
+@test "(domains) urls do not glob expand a catch-all domain" {
+  local tmp_dir
+  tmp_dir="$(mktemp -d)"
+  touch "$tmp_dir/glob-canary"
+  chmod 755 "$tmp_dir"
+
+  run /bin/bash -c "dokku proxy:set $TEST_APP caddy"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku domains:set $TEST_APP '*'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "cd $tmp_dir && dokku urls $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  rm -rf "$tmp_dir"
+  assert_success
+  assert_output_contains "glob-canary" 0
+  assert_output_contains "http://*"
+}