mirror of
https://github.com/coollabsio/coolify.git
synced 2026-11-04 10:42:23 +00:00
Andras Bacsai
1f4006ac49
Remove tests that copy app logic into the test, grep PHP source as text, only check literals, constants, class_exists or PHP built-ins, duplicate other tests, or are always skipped. Keep source checks that guard security and authorization rules. Rename a duplicate Pest helper so the full suite loads, drop the missing v5/Browser path, and remove the CLAUDE.md symlink in favor of AGENTS.md. Correct AGENTS.md: Dusk is not installed and the upgrade script is scripts/upgrade.sh.
63 lines
3.0 KiB
PHP
63 lines
3.0 KiB
PHP
<?php
|
|
|
|
/**
|
|
* Regression tests for database healthcheck command injection.
|
|
*
|
|
* Docker CMD-SHELL healthchecks pass the string to /bin/sh -c, enabling command injection
|
|
* via user-controlled DB username/password/database fields. The fix converts all affected
|
|
* healthchecks to CMD exec-form arrays, which bypass the shell entirely.
|
|
*/
|
|
|
|
// ─── PostgreSQL ──────────────────────────────────────────────────────────────
|
|
|
|
test('postgresql healthcheck uses CMD exec-form, not CMD-SHELL', function () {
|
|
$source = file_get_contents(__DIR__.'/../../app/Actions/Database/StartPostgresql.php');
|
|
|
|
expect($source)->not->toContain('CMD-SHELL');
|
|
expect($source)->toContain("'CMD', 'psql'");
|
|
});
|
|
|
|
// ─── KeyDB ────────────────────────────────────────────────────────────────────
|
|
|
|
test('keydb healthcheck uses CMD exec-form, not a CMD-SHELL string', function () {
|
|
$source = file_get_contents(__DIR__.'/../../app/Actions/Database/StartKeydb.php');
|
|
|
|
expect($source)->not->toContain('CMD-SHELL');
|
|
expect($source)->toContain("'CMD', 'keydb-cli'");
|
|
});
|
|
|
|
// ─── Dragonfly ────────────────────────────────────────────────────────────────
|
|
|
|
test('dragonfly healthcheck uses CMD exec-form, not a CMD-SHELL string', function () {
|
|
$source = file_get_contents(__DIR__.'/../../app/Actions/Database/StartDragonfly.php');
|
|
|
|
expect($source)->not->toContain('CMD-SHELL');
|
|
expect($source)->toContain("'CMD', 'redis-cli'");
|
|
});
|
|
|
|
// ─── ClickHouse ───────────────────────────────────────────────────────────────
|
|
|
|
test('clickhouse healthcheck uses CMD exec-form, not a CMD-SHELL string', function () {
|
|
$source = file_get_contents(__DIR__.'/../../app/Actions/Database/StartClickhouse.php');
|
|
|
|
expect($source)->not->toContain('CMD-SHELL');
|
|
expect($source)->toContain("'CMD', 'clickhouse-client'");
|
|
});
|
|
|
|
// ─── Verify unaffected databases still use their safe patterns ────────────────
|
|
|
|
test('mysql healthcheck already uses CMD exec-form (no regression)', function () {
|
|
$source = file_get_contents(__DIR__.'/../../app/Actions/Database/StartMysql.php');
|
|
|
|
// MySQL already used CMD array form — ensure it stays that way
|
|
expect($source)->toContain("'CMD', 'mysqladmin'");
|
|
});
|
|
|
|
test('mariadb healthcheck uses safe fixed script (no regression)', function () {
|
|
$source = file_get_contents(__DIR__.'/../../app/Actions/Database/StartMariadb.php');
|
|
|
|
expect($source)->toContain('healthcheck.sh');
|
|
// Must not have gained any user-field interpolation
|
|
expect($source)->not->toMatch('/CMD-SHELL.*mariadb/i');
|
|
});
|