Files
dokku/tests/unit
Jose Diaz-Gonzalez 93f87a0f07 fix: restrict app names to prevent command injection
The previous app name validation regex permitted shell metacharacters such as `;`, `$`, backticks, `|`, and `&`. These names were embedded unquoted into the generated git pre-receive hook script, allowing an authenticated user to execute arbitrary commands as the dokku user simply by pushing to a remote with a crafted app name. App names are now restricted to lowercase alphanumerics, dots, and hyphens, and the hook script also quotes the app variable as a defense-in-depth measure.
2026-05-09 16:00:51 -04:00
..
2026-04-27 01:05:41 -04:00
2026-05-04 13:16:28 -04:00
2017-02-24 12:41:12 -03:00
2024-03-13 07:47:54 -04:00
2024-03-13 07:47:54 -04:00
2026-04-30 18:40:57 -04:00
2024-01-19 03:51:21 -05:00
2024-02-27 14:19:53 -05:00
2024-02-25 15:54:31 -05:00
2025-11-18 17:06:30 -05:00
2025-11-09 20:21:10 -05:00
2026-05-08 21:38:22 -04:00