HandleVolumeAdd accepts host_path and container_path from the form and passes them directly to the database without calling validateVolumePaths(). The validation function exists and is correctly used in HandleVolumeEdit (app.go:1176), but was missed in the add handler.
// HandleVolumeAdd — NO validationvolume.HostPath=hostPathvolume.ContainerPath=containerPath// HandleVolumeEdit — HAS validationpathErr:=validateVolumePaths(hostPath,containerPath)ifpathErr!=nil{...}
Without validation, relative paths, non-clean paths (containing ..), and empty paths can be stored and later passed to Docker as bind mount sources.
Impact
A volume with a relative or traversal path (e.g. ../../etc) could be created and used in the next deploy, potentially mounting unintended host directories into the container.
Suggested Fix
Add validateVolumePaths(hostPath, containerPath) check in HandleVolumeAdd before saving, same as HandleVolumeEdit.
## Severity: HIGH
## File & Line
`internal/handlers/app.go:978-1005`
## Description
`HandleVolumeAdd` accepts `host_path` and `container_path` from the form and passes them directly to the database without calling `validateVolumePaths()`. The validation function exists and is correctly used in `HandleVolumeEdit` (app.go:1176), but was missed in the add handler.
```go
// HandleVolumeAdd — NO validation
volume.HostPath = hostPath
volume.ContainerPath = containerPath
// HandleVolumeEdit — HAS validation
pathErr := validateVolumePaths(hostPath, containerPath)
if pathErr != nil { ... }
```
Without validation, relative paths, non-clean paths (containing `..`), and empty paths can be stored and later passed to Docker as bind mount sources.
## Impact
A volume with a relative or traversal path (e.g. `../../etc`) could be created and used in the next deploy, potentially mounting unintended host directories into the container.
## Suggested Fix
Add `validateVolumePaths(hostPath, containerPath)` check in `HandleVolumeAdd` before saving, same as `HandleVolumeEdit`.
clawbot
added this to the 1.0 milestone 2026-02-20 12:28:40 +01:00
clawbot
added the bug label 2026-02-20 12:28:40 +01:00
clawbot
self-assigned this 2026-02-20 12:28:40 +01:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Severity: HIGH
File & Line
internal/handlers/app.go:978-1005Description
HandleVolumeAddacceptshost_pathandcontainer_pathfrom the form and passes them directly to the database without callingvalidateVolumePaths(). The validation function exists and is correctly used inHandleVolumeEdit(app.go:1176), but was missed in the add handler.Without validation, relative paths, non-clean paths (containing
..), and empty paths can be stored and later passed to Docker as bind mount sources.Impact
A volume with a relative or traversal path (e.g.
../../etc) could be created and used in the next deploy, potentially mounting unintended host directories into the container.Suggested Fix
Add
validateVolumePaths(hostPath, containerPath)check inHandleVolumeAddbefore saving, same asHandleVolumeEdit.