BUG: App name not validated server-side, only client-side HTML pattern #37

New Issue

2026-02-16T06:56:32+01:00

clawbot commented

2026-02-16 06:56:32 +01:00

Severity: MEDIUM

File: `internal/handlers/app.go` lines 44-79 (HandleAppCreate, HandleAppUpdate)

Description

The app name is used directly in:

Docker container names: "upaas-" + app.Name (deploy.go)
Docker image tags: "upaas-%s:%d" (deploy.go)
File system paths for build dirs and log files (deploy.go)
The HTML pattern="[a-z0-9-]+" attribute is only client-side validation

A crafted POST request bypassing the browser can submit names with spaces, special characters, path separators, etc., potentially causing:

Docker API errors with invalid container/image names
Path traversal in build directories
Log injection via app names in log messages

Suggested Fix

Add server-side validation matching the client-side pattern:

var validAppNameRe = regexp.MustCompile(`^[a-z0-9][a-z0-9-]*[a-z0-9]$`)

func validateAppName(name string) error {
    if len(name) < 2 || len(name) > 63 {
        return fmt.Errorf("name must be 2-63 characters")
    }
    if !validAppNameRe.MatchString(name) {
        return fmt.Errorf("name must contain only lowercase letters, numbers, and hyphens")
    }
    return nil
}

Apply this in both HandleAppCreate and HandleAppUpdate.

## Severity: MEDIUM ## File: `internal/handlers/app.go` lines 44-79 (HandleAppCreate, HandleAppUpdate) ## Description The app name is used directly in: - Docker container names: `"upaas-" + app.Name` (deploy.go) - Docker image tags: `"upaas-%s:%d"` (deploy.go) - File system paths for build dirs and log files (deploy.go) - The HTML `pattern="[a-z0-9-]+"` attribute is only client-side validation A crafted POST request bypassing the browser can submit names with spaces, special characters, path separators, etc., potentially causing: - Docker API errors with invalid container/image names - Path traversal in build directories - Log injection via app names in log messages ## Suggested Fix Add server-side validation matching the client-side pattern: ```go var validAppNameRe = regexp.MustCompile(`^[a-z0-9][a-z0-9-]*[a-z0-9]$`) func validateAppName(name string) error { if len(name) < 2 || len(name) > 63 { return fmt.Errorf("name must be 2-63 characters") } if !validAppNameRe.MatchString(name) { return fmt.Errorf("name must contain only lowercase letters, numbers, and hyphens") } return nil } ``` Apply this in both `HandleAppCreate` and `HandleAppUpdate`.

sneak commented

2026-02-16 07:02:22 +01:00

yes. give me a PR

clawbot referenced a pull request that will close this issue

2026-02-16 07:06:23 +01:00

Add server-side app name validation (closes #37) #49

sneak closed this issue

2026-02-16 07:07:48 +01:00

sneak referenced this issue from a commit

2026-02-16 07:07:49 +01:00

Add server-side app name validation (closes #37)

sneak referenced this issue from a commit