{"record":{"id":"4f7f9b09593f020e","repo":"coollabsio/coolify","slug":"invalid-container-name-format","errorCode":null,"errorMessage":"Invalid container name format","messagePattern":"Invalid container name format","errorType":"exception","errorClass":"InvalidArgumentException","httpStatus":null,"severity":"error","filePath":"app/Livewire/Project/Shared/ExecuteContainerCommand.php","lineNumber":206,"sourceCode":"            return handleError($e, $this);\n        } finally {\n            $this->isConnecting = false;\n        }\n    }\n\n    #[On('connectToContainer')]\n    public function connectToContainer()\n    {\n        if ($this->selected_container === 'default') {\n            $this->dispatch('error', 'Please select a container.');\n\n            return;\n        }\n        try {\n            $this->authorize('canAccessTerminal');\n            // Validate container name format\n            if (! ValidationPatterns::isValidContainerName($this->selected_container)) {\n                throw new \\InvalidArgumentException('Invalid container name format');\n            }\n\n            // Verify container exists in our allowed list\n            $container = collect($this->containers)->firstWhere('container.Names', $this->selected_container);\n            if (is_null($container)) {\n                throw new \\RuntimeException('Container not found.');\n            }\n\n            // Verify server ownership and status\n            $server = data_get($container, 'server');\n            if (! $server || ! $server instanceof Server) {\n                throw new \\RuntimeException('Invalid server configuration.');\n            }\n\n            $this->authorize('view', $server);\n\n            if ($server->isForceDisabled()) {\n                throw new \\RuntimeException('Server is disabled.');","sourceCodeStart":188,"sourceCodeEnd":224,"githubUrl":"https://github.com/coollabsio/coolify/blob/70b9acc42467278373e00de77abb40684e25b395/app/Livewire/Project/Shared/ExecuteContainerCommand.php#L188-L224","documentation":"Thrown by the connectToContainer terminal action when selected_container fails ValidationPatterns::isValidContainerName(), which enforces the allowlist regex /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/. The name is later interpolated into docker exec commands, so this is a command-injection guard: shell metacharacters, whitespace, or an illegal first character are rejected before any SSH/Docker call. It runs after authorize('canAccessTerminal') as defense-in-depth, because Livewire request payloads (and replayed snapshots) can be tampered with client-side.","triggerScenarios":"Dispatching the connectToContainer event with selected_container containing $(), backticks, ;, |, &&, spaces or newlines, or a value starting with -, . or _ (e.g. '-container', '.container'). Typically a hand-crafted or replayed Livewire update request, a stale snapshot whose property no longer matches a real Docker name, or a security scanner poking at the endpoint.","commonSituations":"Penetration testing / automated scanners posting crafted wire updates; browser devtools editing of the component state; stale tabs from before a container rename; tooling that passes container IDs with unusual prefixes.","solutions":["Re-select a container from the dropdown so selected_container matches ^[a-zA-Z0-9][a-zA-Z0-9._-]*$ again","Reload the page so the containers list and the selected_container property resynchronize","If calling this from custom code, pre-validate with ValidationPatterns::isValidContainerName($name) before dispatching connectToContainer","If it recurs with normal UI usage, inspect the outgoing Livewire request payload for tampering (check the wire update for the selected_container property)"],"exampleFix":"// before\n$this->dispatch('connectToContainer', container: $request->input('name'));\n\n// after\nuse App\\Support\\ValidationPatterns;\n\nif (ValidationPatterns::isValidContainerName($name)) {\n    $this->dispatch('connectToContainer', container: $name);\n} else {\n    $this->dispatch('error', 'Invalid container name format');\n}","handlingStrategy":"validation","validationCode":"use App\\Support\\ValidationPatterns;\n\n$ok = is_string($name)\n    && ValidationPatterns::isValidContainerName($name); // ^[a-zA-Z0-9][a-zA-Z0-9._-]*$\nif (! $ok) {\n    // reject before dispatching connectToContainer / any docker exec path\n}","typeGuard":null,"tryCatchPattern":"In the Livewire action, keep the format check before any Docker/SSH call and catch \\InvalidArgumentException separately from \\RuntimeException, routing both through handleError($e, $this) / dispatch('error', ...). Never echo the raw submitted name back in the message.","preventionTips":["Populate selected_container only from the server-provided containers list, never from free-form client input","Keep the allowlist regex in sync with Docker's own naming rules when extending code","Treat repeated hits as tampering signals - inspect the Livewire request payload"],"tags":["docker","command-injection","validation","livewire","terminal"],"backgroundTag":"shell-command-injection-guard","analyzedSha":"70b9acc42467278373e00de77abb40684e25b395","analyzedAt":"2026-08-17T01:41:01.313Z","schemaVersion":2},"datasetVersion":"2026-08-17T04:17:16.089Z"}