jjkiers/cloudron-box
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

app proxy: protect code accessing containerId

Browse Source
This commit is contained in:
Girish Ramakrishnan
2024-06-10 10:53:00 +02:00
parent db3eabcd2f
commit 692be297b3
4 changed files with 19 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/apps.js
View File

@@ -1502,6 +1502,8 @@ async function setUpstreamUri(app, upstreamUri, auditSource) {
assert.strictEqual(typeof upstreamUri, 'string');
assert.strictEqual(typeof auditSource, 'object');
if (app.manifest.id !== constants.PROXY_APP_APPSTORE_ID) throw new BoxError(BoxError.BAD_FIELD, 'upstreamUri can only be set for proxy app');
const appId = app.id;
const error = validateUpstreamUri(upstreamUri);
if (error) throw error;
@@ -2109,6 +2111,8 @@ async function getLogs(app, options) {
assert.strictEqual(typeof options.format, 'string');
assert.strictEqual(typeof options.follow, 'boolean');
if (app.manifest.id !== constants.PROXY_APP_APPSTORE_ID) throw new BoxError(BoxError.BAD_FIELD, 'upstreamUri can only be set for proxy app');
const appId = app.id;
const logPaths = await getLogPaths(app);
@@ -2510,6 +2514,8 @@ async function createExec(app, options) {
assert.strictEqual(typeof app, 'object');
assert(options && typeof options === 'object');
if (app.manifest.id !== constants.PROXY_APP_APPSTORE_ID) throw new BoxError(BoxError.BAD_FIELD, 'upstreamUri can only be set for proxy app');
const cmd = options.cmd || [ '/bin/bash' ];
assert(Array.isArray(cmd) && cmd.length > 0);