starred/coolify
1
0
Fork 0
mirror of https://github.com/coollabsio/coolify.git synced 2026-10-07 22:45:27 -04:00
Code Issues Packages Projects Releases Wiki Activity

Improve volume path handling (#11993)

Browse Source
This commit is contained in:
Andras Bacsai
2026-09-24 23:22:35 +02:00
committed by GitHub
parent 50f49f093e
commit 0935bf141e
6 changed files with 248 additions and 62 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/Unit/VolumeArrayFormatSecurityTest.php
+33
View File
@@ -243,6 +243,39 @@ YAML;
->toThrow(Exception::class);
});
test('compose validator rejects unsafe array source defaults', function (string $source) {
$compose = "services:\n web:\n image: nginx\n volumes:\n - type: bind\n source: '".$source."'\n target: /app\n";
expect(fn () => validateDockerComposeForInjection($compose))
->toThrow(Exception::class, 'Invalid Docker volume definition');
})->with([
'${DATA:-/tmp/evil`id`}',
'${DATA:-/tmp/evil$(id)}',
'${DATA:-/tmp/evil;id}',
'${DATA:-/tmp/evil|id}',
'${DATA:-/tmp/evil$(id)}/config.yml',
'${DATA:-${HOME:-$(id)}/config.yml}',
'${DATA:+/srv/app;id}/config.yml',
'${DATA:?missing;id}',
'${DATA?$(id)}',
'${DATA-/tmp/evil`id`}',
'${DATA+/tmp/evil|id}',
'/srv/$HOME/evil`id`',
]);
test('compose validator keeps safe array source expressions', function (string $source) {
$compose = "services:\n web:\n image: nginx\n volumes:\n - type: bind\n source: '".$source."'\n target: /app\n";
expect(fn () => validateDockerComposeForInjection($compose))->not->toThrow(Exception::class);
})->with(['${DATA}', '${DATA}/config', '${DATA}//config', '${DATA:-/srv/app/data}', '/srv/$HOME/config.yml', '$HOME/$FILE', '${DATA:-/srv/$HOME/config.yml}']);
test('compose validator keeps unsupported array source forms rejected', function (string $source) {
$compose = "services:\n web:\n image: nginx\n volumes:\n - type: bind\n source: '".$source."'\n target: /app\n";
expect(fn () => validateDockerComposeForInjection($compose))
->toThrow(Exception::class, 'Invalid Docker volume definition');
})->with(['${DATA:+/srv/app}', '${DATA:-${HOME}/config.yml}', '${DATA:-/srv/app}/file', '${DATA:?missing}', '${DATA?missing}', '${DATA-/srv/app}', '${DATA+/srv/app}']);
test('mixed string and array format volumes in same compose', function () {
$dockerComposeYaml = <<<'YAML'
services: