Jose Diaz-Gonzalez ac95225809 fix: prevent host shell injection from app.json cron commands ...

The docker-local scheduler wrote each app.json cron command verbatim into the dokku user's crontab, where cron's `bash -c` interpreted any shell metacharacters in the command on the host as the dokku user rather than inside the container. The crontab line is now `dokku cron:run <app> <cron-id>`, and the command is resolved from app.json and exec'd inside the container at run time. Commands containing shell operators are also rejected when app.json is validated at deploy time.

2026-05-25 02:14:21 -04:00

6.9 KiB

Raw Blame History

View Raw