hotel-manage-stack/management
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
No description
19 commits 1 branch 0 tags 179 KiB
Find a file
jtricerolph 90c2e69d51 Replace execSync/exec shell interpolation with spawn arg arrays in updater 
sshGet() and deploy() built SSH commands via template literal string
interpolation, which would allow shell injection if host/path values
from the app registry were tampered with. Replaced with spawnAsync()
using shell: false and explicit argv arrays. Added path validation
guard (/^\/opt\/[a-z0-9-]+$/) before both SSH calls. Also removes
the event-loop-blocking execSync in deploy().

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-07-13 09:25:09 +00:00
backup Initial commit: management 2026-07-01 12:09:54 +00:00
updater Replace execSync/exec shell interpolation with spawn arg arrays in updater 2026-07-13 09:25:09 +00:00
.env.example Replace static deploy-map with dynamic auth registry 2026-07-01 20:49:39 +00:00
.gitignore Initial commit: management 2026-07-01 12:09:54 +00:00
docker-compose.yml Pass CENTRAL_AUTH_SECRET and AUTH_URL to updater container 2026-07-01 20:55:51 +00:00