Jose Diaz-Gonzalez 2df0791fcd fix: prevent tar symlink traversal in archive extraction ...

Archives passed to git:from-archive and certs:add were extracted without symlink or path validation, allowing a crafted archive to write arbitrary files anywhere writable by the dokku user via symlink traversal. Extraction now pre-scans entries for absolute paths, parent traversal, and unsafe symlinks, applies the GNU tar `--no-unsafe-links` flag when available, and validates symlinks after extraction.

2026-05-09 12:54:42 -04:00

..

src

feat: migrate environment variables to plugin properties

2026-04-25 05:11:07 -04:00

.gitignore

fix: add missing app-list entry to config gitignore

2022-11-24 13:47:54 -05:00

archive-functions

fix: prevent tar symlink traversal in archive extraction

2026-05-09 12:54:42 -04:00

common_test.go

feat: accept --global on :report subcommands

2026-04-29 10:30:59 -04:00

common.go

feat: accept --global on :report subcommands

2026-04-29 10:30:59 -04:00

data.go

fix: ensure we continue on with logic if the error returned from fetching all apps is NoAppsExist

2025-12-05 20:16:15 -05:00

deploy

feat: allow specifying a single process type to restart

2021-10-09 18:46:17 -04:00

docker.go

feat: migrate environment variables to plugin properties

2026-04-25 05:11:07 -04:00

exec.go

feat: add PrintCommand support to all task executors

2025-11-09 20:21:10 -05:00

functions

fix: prevent tar symlink traversal in archive extraction

2026-05-09 12:54:42 -04:00

functions.go

fix: ensure all report subcommands exit 0 when there is no app

2025-02-02 01:37:20 -05:00

go.mod

chore(deps): bump github.com/onsi/gomega in /plugins/common

2026-04-29 12:16:18 -04:00

go.sum

chore(deps): bump github.com/onsi/gomega in /plugins/common

2026-04-29 12:16:18 -04:00

io_test.go

fix: correct io tests

2020-11-21 20:57:33 -05:00

io.go

fix: do not change permissions on config directory symlinks

2025-08-11 23:46:14 -04:00

log.go

fix: do not print errors twice

2025-11-13 01:52:08 -05:00

Makefile

fix: propagate arm64 build support for development builds

2024-01-18 19:19:53 -05:00

parallel.go

feat: short-circuit report fetching if only retrieving a single value

2020-12-30 00:37:43 -05:00

plugin.toml

Release 0.38.1

2026-05-07 17:29:53 +00:00

plugn.go

feat: add PrintCommand support to all task executors

2025-11-09 20:21:10 -05:00

properties.go

refactor: move the env files to the new path on upgrade

2026-04-27 01:06:29 -04:00

property-functions

feat: add support for dns-01 challenge mode when using traefik

2026-01-07 01:16:05 -05:00

release-and-deploy

refactor: extract release_and_deploy calls to a plugin trigger

2020-11-21 20:57:33 -05:00

sftp.go

feat: add PrintCommand support to all task executors

2025-11-09 20:21:10 -05:00

ssh.go

feat: add PrintCommand support to all task executors

2025-11-09 20:21:10 -05:00

subprocess.go

chore: remove codeskyblue/go-sh

2024-03-14 03:14:22 -04:00

triggers.go

fix: ensure we continue on with logic if the error returned from fetching all apps is NoAppsExist

2025-12-05 20:16:15 -05:00