github/dokku
0
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity
Files
a70728f61eee7be181cf6a271ef1ab4f74760f3c
dokku/tests/unit
History
Jose Diaz-Gonzalez a70728f61e fix: sanitize openresty include filenames to prevent eval injection 
Add defense-in-depth sanitization for OpenResty include files to prevent
OS command injection via malicious filenames that break shell quoting in eval.

- Add filename validation in core-post-extract using regex [^a-zA-Z0-9_.-]
- Validate both http-includes and location-includes paths
- Abort deploy via dokku_log_fail on unsafe filenames
- Skip non-regular files (symlinks, directories) during extraction
- Add security regression test with unsafe filename containing space
- Keep existing guards in docker-args-process-deploy as belt-and-suspenders
- Update documentation to clarify allowed filename characters

Addresses CVSS 9.9 vulnerability where filenames like poc'$(cmd)'x.conf
could escape shell quoting and execute arbitrary commands during deploy.
2026-05-09 12:20:50 -04:00
..
app-json-2.bats
tests: make it possible to specify an alternative base domain for tests
2023-08-05 20:58:26 -04:00
app-json-3.bats
tests: make it possible to specify an alternative base domain for tests
2023-08-05 20:58:26 -04:00
app-json-4.bats
chore: make the postdeploy task name more clear
2025-11-20 00:42:49 -05:00
app-json-5.bats
feat: add post-create support for env key in app.json
2026-04-26 22:43:32 -04:00
app-json.bats
fix(tests): adapt app.json fixtures and tini test for env processing
2026-04-26 22:43:32 -04:00
apps_1.bats
feat: migrate environment variables to plugin properties
2026-04-25 05:11:07 -04:00
apps_2.bats
Merge pull request #8493 from dokku/6760-build-empty-nginx-config-when-there-are-no-web-processes
2026-04-26 04:08:17 -04:00
build-env.bats
refactor: remove public exposure of DOKKU_APP_TYPE in favor of builder detected property
2025-08-21 23:59:41 -04:00
builder-dockerfile.bats
test: use BATS_TEST_TMPDIR in core-post-extract regression tests
2026-05-08 01:34:05 -04:00
builder-herokuish.bats
fix: preserve info flag in plugin reports with --global
2026-04-30 21:05:46 -04:00
builder-lambda.bats
test: use BATS_TEST_TMPDIR in core-post-extract regression tests
2026-05-08 01:34:05 -04:00
builder-nixpacks.bats
test: use BATS_TEST_TMPDIR in core-post-extract regression tests
2026-05-08 01:34:05 -04:00
builder-pack.bats
test: use BATS_TEST_TMPDIR in core-post-extract regression tests
2026-05-08 01:34:05 -04:00
builder-railpack.bats
test: use BATS_TEST_TMPDIR in core-post-extract regression tests
2026-05-08 01:34:05 -04:00
builder.bats
feat: accept --global on :report subcommands
2026-04-29 10:30:59 -04:00
buildpacks.bats
fix: remove buildpacks from dockerfile test app and add tests for app.json buildpacks
2026-04-18 05:43:44 -04:00
builds.bats
fix: chown test-fixture build records to dokku user
2026-04-30 02:58:18 -04:00
caddy.bats
fix: preserve info flag in plugin reports with --global
2026-04-30 21:05:46 -04:00
certs.bats
fix: preserve info flag in plugin reports with --global
2026-04-30 21:05:46 -04:00
checks.bats
fix: preserve info flag in plugin reports with --global
2026-04-30 21:05:46 -04:00
client.bats
fix: properly use $1 as default value
2025-11-20 02:21:20 -05:00
config-oddities.bats
fix: reference env from config dir
2026-04-27 01:05:41 -04:00
config.bats
fix: reference env from config dir
2026-04-27 01:05:41 -04:00
core_1.bats
refactor: only use detected port mapping if override is not specified
2023-08-05 10:58:57 -04:00
core_2.bats
chore: remove now invalid tests
2026-05-04 13:16:28 -04:00
cron.bats
test: drop cron:set in cron:report --global test
2026-04-29 10:31:02 -04:00
docker-options-2.bats
test: cover migration via go unit test
2026-04-29 03:14:17 -04:00
docker-options.bats
fix: split multi-flag input in docker-options
2026-04-29 13:15:51 -04:00
domain_ssl.tar
add domain_ssl tar for testing
2017-02-24 12:41:12 -03:00
domains.bats
fix: preserve info flag in plugin reports with --global
2026-04-30 21:05:46 -04:00
events.bats
tests: add assertions to various bats tests
2023-08-05 10:58:57 -04:00
git_1.bats
fix: update test for newer git version
2025-02-27 22:38:18 -05:00
git_2.bats
tests: add assertions to various bats tests
2023-08-05 10:58:57 -04:00
git_3.bats
fix: preserve info flag in plugin reports with --global
2026-04-30 21:05:46 -04:00
git_4.bats
feat: add a method to force build when re-using an image with git:from-image
2026-01-08 02:46:53 -05:00
git_5.bats
tests: make it possible to specify an alternative base domain for tests
2023-08-05 20:58:26 -04:00
git_6.bats
chore: rename test files
2024-03-13 07:47:54 -04:00
git_7.bats
chore: rename test files
2024-03-13 07:47:54 -04:00
haproxy.bats
fix: deflake haproxy bats tests
2026-04-30 18:40:57 -04:00
init.bats
tests: add assertions to various bats tests
2023-08-05 10:58:57 -04:00
logs.bats
fix: use newer qson to add support for escaped = (equals) signs
2025-08-12 20:15:27 -04:00
network.bats
feat: accept --global on :report subcommands
2026-04-29 10:30:59 -04:00
nginx-vhosts_1.bats
fix: preserve info flag in plugin reports with --global
2026-04-30 21:05:46 -04:00
nginx-vhosts_2.bats
tests: make it possible to specify an alternative base domain for tests
2023-08-05 20:58:26 -04:00
nginx-vhosts_3.bats
fix: update the test
2024-01-19 03:51:21 -05:00
nginx-vhosts_4.bats
tests: make it possible to specify an alternative base domain for tests
2023-08-05 20:58:26 -04:00
nginx-vhosts_5.bats
fix: move proxy-port properties to proxy plugin and fix CI failures
2026-04-25 17:19:42 -04:00
nginx-vhosts_6.bats
tests: add assertions to various bats tests
2023-08-05 10:58:57 -04:00
nginx-vhosts_7.bats
feat: pre-validate custom nginx.conf.sigil during core-post-extract
2026-04-29 05:01:25 -04:00
nginx-vhosts_8.bats
refactor: consolidate property fetching for nginx plugin into golang codebase
2024-02-06 00:42:48 -05:00
nginx-vhosts_9.bats
tests: update test
2024-02-27 14:19:53 -05:00
nginx-vhosts_10.bats
tests: add assertions to various bats tests
2023-08-05 10:58:57 -04:00
nginx-vhosts_11.bats
tests: make it possible to specify an alternative base domain for tests
2023-08-05 20:58:26 -04:00
nginx-vhosts_12.bats
tests: make it possible to specify an alternative base domain for tests
2023-08-05 20:58:26 -04:00
nginx-vhosts_13.bats
fix(tests): update config and nginx tests for post-create side effects
2026-04-24 05:02:49 -04:00
nginx-vhosts_14.bats
fix: remove sites-enabled default instead of renaming
2026-04-27 14:43:20 -04:00
nginx-vhosts_15.bats
feat: pre-validate custom nginx.conf.sigil during core-post-extract
2026-04-29 05:01:25 -04:00
nginx-vhosts_16.bats
test: relax ssl_certificate occurrence count in nginx-vhosts_16
2026-04-30 17:30:03 -04:00
openresty.bats
fix: sanitize openresty include filenames to prevent eval injection
2026-05-09 12:20:50 -04:00
osx_ssl_tarred.tar
Make sure we ignore hidden files in the SSL cert check
2016-01-06 14:36:07 +01:00
plugin.bats
refactor: move plugin test helper functions to test_helper.bash
2024-03-13 22:21:05 -04:00
ports.bats
fix: do not reset manually set port mappings when upgrading dokku
2025-11-20 00:21:40 -05:00
proxied-app.bats
tests: make it possible to specify an alternative base domain for tests
2023-08-05 20:58:26 -04:00
proxy.bats
fix: guard against invalid proxy values due to move of port mapping to ports plugin
2024-04-04 23:01:59 -04:00
ps-dockerfile-1.bats
tests: add assertions to various bats tests
2023-08-05 10:58:57 -04:00
ps-dockerfile-2.bats
tests: add tests for scaling without restarting untouched process types
2025-06-30 01:48:09 -04:00
ps-general-1.bats
fix: escape the dollar-sign so it gets properly set in the Procfile
2025-10-26 23:45:08 -04:00
ps-general-2.bats
tests: update expected output
2025-12-25 18:34:39 -05:00
ps-herokuish-1.bats
tests: add assertions to various bats tests
2023-08-05 10:58:57 -04:00
ps-herokuish-2.bats
tests: add assertions to various bats tests
2023-08-05 10:58:57 -04:00
registry.bats
feat: add the ability to log into a registry on a per-app basis
2026-01-09 00:12:16 -05:00
repo.bats
fix: remove reference to cache dir
2024-02-25 15:54:31 -05:00
report.bats
fix: ensure we can call storage:report properly
2026-01-25 22:58:10 -05:00
resource_1.bats
tests: add assertions to various bats tests
2023-08-05 10:58:57 -04:00
resource_2.bats
tests: add assertions to various bats tests
2023-08-05 10:58:57 -04:00
resource_3.bats
test: add run_plugn_trigger and run_plugin_script bats helpers
2026-05-07 12:47:00 -04:00
run_1.bats
chore: fix lint issues
2025-11-18 17:06:30 -05:00
run_2.bats
tests: fix expected output of --quiet
2025-11-19 20:23:53 -05:00
scheduler-docker-local.bats
fix: preserve info flag in plugin reports with --global
2026-04-30 21:05:46 -04:00
scheduler-k3s-1.bats
fix: remove extra _
2025-11-09 20:21:10 -05:00
scheduler-k3s-2.bats
test: fix issue where teardown was not being called
2025-11-09 23:16:39 -05:00
scheduler-k3s-3.bats
tests: add test for security context conversions
2025-09-14 02:19:25 -04:00
scheduler-k3s-4.bats
fix: only emit keda fallback when a non-cpu/memory trigger exists
2026-04-29 01:10:34 -04:00
scheduler-k3s-certs-2.bats
fix: delete the tls app chart when the app is deleted
2026-01-10 02:52:01 -05:00
scheduler-k3s-certs-deploy.bats
feat: use certificates imported by certs plugin when deploying via scheduler-k3s
2026-01-08 01:05:40 -05:00
scheduler-k3s-certs.bats
feat: use certificates imported by certs plugin when deploying via scheduler-k3s
2026-01-08 01:05:40 -05:00
scheduler-k3s-secrets-deploy.bats
fix: thread secret annotations and labels through new helm charts
2026-04-29 12:18:06 -04:00
scheduler-k3s-secrets.bats
fix: split env config and image pull secret into separate helm releases
2026-04-29 12:18:03 -04:00
server_ssl_sans.tar
fix: use correct path within the ssl tarballs
2023-01-16 01:50:52 -05:00
server_ssl_wildcard.tar
fix: use correct path within the ssl tarballs
2023-01-16 01:50:52 -05:00
server_ssl.tar
fix: use correct path within the ssl tarballs
2023-01-16 01:50:52 -05:00
ssh_keys.bats
chore: run shfmt against all test files
2022-07-21 14:57:42 -04:00
storage.bats
fix: chown migrated legacy storage entries to dokku
2026-05-02 05:37:11 -04:00
test_helper.bash
test: add run_plugn_trigger and run_plugin_script bats helpers
2026-05-07 12:47:00 -04:00
trace.bats
feat: split out test files and execute them manually
2020-06-20 13:22:47 -04:00
traefik.bats
fix: preserve info flag in plugin reports with --global
2026-04-30 21:05:46 -04:00
version.bats
feat: split out test files and execute them manually
2020-06-20 13:22:47 -04:00