Skip to content

v0.4.1 - Security and Bug Fixes

Choose a tag to compare

View all tags
@stdhkr stdhkr released this 20 Nov 14:44
· 42 commits to main since this release
v0.4.1
96c96d6
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

🔒 Security Improvements

This release focuses on preventing command injection vulnerabilities in all Docker-related operations.

Security Fixes

  • Command injection prevention: Migrated all Docker CLI operations from execSync/exec to safe spawn/spawnSync execution
  • Input validation: Added comprehensive validation for all Docker endpoints
    • Container name/ID format validation (alphanumeric + Docker characters)
    • RFC3339 timestamp validation for log queries
    • Directory path validation with shell injection prevention
  • Path validation utility: New server/utils/path-validation.ts for secure directory operations

Bug Fixes

  • Icon cache lookup: Fixed .png extension handling causing cache misses
  • Docker port mapping: Improved regex to support all binding formats (IPv4, IPv6, wildcard, specific IPs)

Technical Details

  • Replace unsafe shell command execution with argument arrays
  • Validate all user inputs before system commands
  • Check for shell injection characters (;, |, &, `, $, etc.)
  • Enforce absolute paths for directory operations
  • Verify directory existence and accessibility

📦 Installation

npx portbd@0.4.1

🔗 Related PRs

  • #36 Security Improvements: Prevent Command Injection Attacks
  • #37 Version bump to 0.4.1

Full Changelog: v0.4.0...v0.4.1

Assets 2
Loading