mirror of
https://github.com/will-moss/isaiah.git
synced 2024-08-22 23:27:15 +03:00
fix(security): added a check to allow only docker run commands in edit container feature
This commit is contained in:
@@ -384,7 +384,7 @@ func (Containers) RunCommand(server *Server, session _session.GenericSession, co
|
|||||||
},
|
},
|
||||||
}),
|
}),
|
||||||
)
|
)
|
||||||
return
|
break
|
||||||
}
|
}
|
||||||
|
|
||||||
var container resources.Container
|
var container resources.Container
|
||||||
@@ -425,12 +425,26 @@ func (Containers) RunCommand(server *Server, session _session.GenericSession, co
|
|||||||
},
|
},
|
||||||
}),
|
}),
|
||||||
)
|
)
|
||||||
return
|
break
|
||||||
}
|
}
|
||||||
|
|
||||||
var container resources.Container
|
var container resources.Container
|
||||||
mapstructure.Decode(command.Args["Resource"], &container)
|
mapstructure.Decode(command.Args["Resource"], &container)
|
||||||
|
|
||||||
|
newCommand := command.Args["Content"].(string)
|
||||||
|
if !strings.HasPrefix(newCommand, "docker run") {
|
||||||
|
server.SendNotification(
|
||||||
|
session,
|
||||||
|
ui.NotificationError(ui.NP{
|
||||||
|
Content: ui.JSON{
|
||||||
|
"Message": "For your own security, you can only run a \"docker run\" command." +
|
||||||
|
" Please make sure that your command starts, indeed, with \"docker run\"",
|
||||||
|
},
|
||||||
|
}),
|
||||||
|
)
|
||||||
|
break
|
||||||
|
}
|
||||||
|
|
||||||
task := process.LongTask{
|
task := process.LongTask{
|
||||||
Function: container.Edit,
|
Function: container.Edit,
|
||||||
Args: command.Args, // Expects : { "Content": <string> }
|
Args: command.Args, // Expects : { "Content": <string> }
|
||||||
|
|||||||
Reference in New Issue
Block a user