starred/coolify
1
0
Fork 0
mirror of https://github.com/coollabsio/coolify.git synced 2026-09-26 09:20:54 -04:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/next' into 8172-investigate-user-delete-bug

Browse Source
This commit is contained in:
Andras Bacsai
2026-04-09 14:08:54 +02:00
parent cb62b0d543 92d1168228
commit e012e98a34
65 changed files with 236 additions and 186 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/Support/ValidationPatterns.php
+3 -2
View File
@@ -40,10 +40,11 @@ class ValidationPatterns
* Blocks dangerous shell metacharacters: ; | ` $ ( ) > < newlines and carriage returns
* Allows & for command chaining (&&) which is common in multi-step build commands
* Allows double quotes for build args with spaces (e.g. --build-arg KEY="value")
* Blocks backslashes and single quotes to prevent escape-sequence attacks
* Blocks backslashes to prevent escape-sequence attacks
* Allows single and double quotes for quoted arguments (e.g. --entrypoint "sh -c 'npm start'")
* Uses [ \t] instead of \s to explicitly exclude \n and \r (which act as command separators)
*/
public const SHELL_SAFE_COMMAND_PATTERN = '/^[a-zA-Z0-9 \t._\-\/=:@,+\[\]{}#%^~&"]+$/';
public const SHELL_SAFE_COMMAND_PATTERN = '/^[a-zA-Z0-9 \t._\-\/=:@,+\[\]{}#%^~&"\']+$/';
/**
* Pattern for Docker volume names