{"record":{"id":"e89b0cd4f258b3bb","repo":"coollabsio/coolify","slug":"invalid-fieldname-contains-forbidden-shell-cha","errorCode":null,"errorMessage":"Invalid {$fieldName}: contains forbidden shell characters.","messagePattern":"Invalid (.+?): contains forbidden shell characters\\.","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"app/Jobs/ApplicationDeploymentJob.php","lineNumber":4688,"sourceCode":"        return $composeFile;\n    }\n\n    private function validatePathField(string $value, string $fieldName): string\n    {\n        if (! preg_match(ValidationPatterns::FILE_PATH_PATTERN, $value)) {\n            throw new \\RuntimeException(\"Invalid {$fieldName}: contains forbidden characters.\");\n        }\n        if (str_contains($value, '..')) {\n            throw new \\RuntimeException(\"Invalid {$fieldName}: path traversal detected.\");\n        }\n\n        return $value;\n    }\n\n    private function validateShellSafeCommand(string $value, string $fieldName): string\n    {\n        if (! preg_match(ValidationPatterns::SHELL_SAFE_COMMAND_PATTERN, $value)) {\n            throw new \\RuntimeException(\"Invalid {$fieldName}: contains forbidden shell characters.\");\n        }\n\n        return $value;\n    }\n\n    private function validateContainerName(string $value): string\n    {\n        if (! preg_match(ValidationPatterns::CONTAINER_NAME_PATTERN, $value)) {\n            throw new \\RuntimeException('Invalid container name: contains forbidden characters.');\n        }\n\n        return $value;\n    }\n\n    /**\n     * Resolve which container to execute a deployment command in.\n     *\n     * For single-container apps, returns the sole container.","sourceCodeStart":4670,"sourceCodeEnd":4706,"githubUrl":"https://github.com/coollabsio/coolify/blob/70b9acc42467278373e00de77abb40684e25b395/app/Jobs/ApplicationDeploymentJob.php#L4670-L4706","documentation":"validateShellSafeCommand() enforces ValidationPatterns::SHELL_SAFE_COMMAND_PATTERN — a token-aware regex allowing whitespace, && and ||, balanced quoted strings, and safe unquoted tokens; it blocks bare & | ; $ ` ( ) < > \\ newlines, unbalanced quotes, and $/backtick inside double quotes. It is applied to user-supplied command/option strings (docker compose commands, docker run options) before they are executed during deployment, preventing shell injection.","triggerScenarios":"A command field contains command substitution ('$(curl ...)'), variable expansion ('$PASSWORD'), statement separators (';', newline), a single '&', parentheses, or an unbalanced quote; any of these in the value passed to validateShellSafeCommand() during the deploy job.","commonSituations":"Users pasting shell one-liners into command option fields; attempting 'echo $FOO && cmd'; entries with a stray unmatched quote from manual editing; trying to background a process with '&'.","solutions":["Remove shell expansions: no $VAR, no backticks, no $(...) — pass values as Docker environment variables / env_file instead.","Keep only && or || as separators; never ';' or single '&'.","Wrap arguments with spaces in balanced double quotes (with no $ inside) or single quotes.","Test the value against the pattern before saving: preg_match(ValidationPatterns::SHELL_SAFE_COMMAND_PATTERN, $value)."],"exampleFix":"# before: expansion and semicolon blocked\ncommand: 'echo $TOKEN; ./migrate --pw=$(cat /run/secret)'\n\n# after: safe tokens only, secrets via env\ndockerfileLocation unchanged; command: 'echo token-set && ./migrate --pw-file /run/secret'\n# TOKEN injected as a container environment variable instead","handlingStrategy":"validation","validationCode":"// Pre-validate command/option strings with the same pattern the deploy job uses\nif (! preg_match(\\App\\Support\\ValidationPatterns::SHELL_SAFE_COMMAND_PATTERN, $value)) {\n    throw new \\InvalidArgumentException('Command contains forbidden shell characters (bare & | ; $ ` ( ) < > \\\\, unbalanced quotes).');\n}","typeGuard":"function isShellSafeCommand(?string $value): bool\n{\n    return blank($value)\n        || preg_match(\\App\\Support\\ValidationPatterns::SHELL_SAFE_COMMAND_PATTERN, $value) === 1;\n}","tryCatchPattern":null,"preventionTips":["Pass secrets via environment variables or env_file — never inline $VAR or $(...) into command fields.","Use && / || only; ';' and single '&' are always rejected.","Test values against ValidationPatterns::SHELL_SAFE_COMMAND_PATTERN in form validation before they reach a deployment."],"tags":["docker","deployment","shell-injection","security","validation"],"backgroundTag":"shell-command-injection-blocked","analyzedSha":"70b9acc42467278373e00de77abb40684e25b395","analyzedAt":"2026-08-17T01:41:01.313Z","schemaVersion":2},"datasetVersion":"2026-08-17T04:17:16.089Z"}