LOW: Container log tail parameter not validated — passed directly to Docker API #24

New Issue

2026-02-16T05:47:13+01:00

clawbot commented

2026-02-16 05:47:13 +01:00

Bug

File: internal/handlers/app.go, HandleAppLogs()

Severity: LOW

Description

The tail query parameter is read from user input and passed directly to the Docker API without validation:

tail := request.URL.Query().Get("tail")
if tail == "" {
    tail = defaultLogTail
}
logs, logsErr := h.docker.ContainerLogs(request.Context(), containerInfo.ID, tail)

While Docker's API likely handles invalid values gracefully, the parameter should be validated as a positive integer to ensure predictable behavior and prevent potential edge cases (e.g., passing "all" to dump the entire log history, which could be a DoS vector for containers with large log files).

Suggested Fix

tail := request.URL.Query().Get("tail")
if tail == "" {
    tail = defaultLogTail
} else if _, err := strconv.Atoi(tail); err != nil {
    tail = defaultLogTail
}

## Bug **File:** `internal/handlers/app.go`, `HandleAppLogs()` **Severity:** LOW ### Description The `tail` query parameter is read from user input and passed directly to the Docker API without validation: ```go tail := request.URL.Query().Get("tail") if tail == "" { tail = defaultLogTail } logs, logsErr := h.docker.ContainerLogs(request.Context(), containerInfo.ID, tail) ``` While Docker's API likely handles invalid values gracefully, the parameter should be validated as a positive integer to ensure predictable behavior and prevent potential edge cases (e.g., passing `"all"` to dump the entire log history, which could be a DoS vector for containers with large log files). ### Suggested Fix ```go tail := request.URL.Query().Get("tail") if tail == "" { tail = defaultLogTail } else if _, err := strconv.Atoi(tail); err != nil { tail = defaultLogTail } ```

sneak commented

2026-02-16 06:48:15 +01:00

do it. also clamp it to max 500.

clawbot referenced a pull request that will close this issue

2026-02-16 06:50:10 +01:00

fix: validate and clamp container log tail parameter (closes #24) #33

sneak closed this issue

2026-02-16 06:51:35 +01:00

sneak referenced this issue from a commit

2026-02-16 06:51:36 +01:00

fix: validate and clamp container log tail parameter (closes #24)

sneak referenced this issue from a commit