From f41f9d25d21183491d1c6d38dbb7714cbf393664 Mon Sep 17 00:00:00 2001 From: Andre Zoledziowski Date: Mon, 21 Jan 2019 15:11:30 +0100 Subject: [PATCH] Fixed possible security problem. --- haproxy.cfg | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/haproxy.cfg b/haproxy.cfg index 433d772..914b990 100644 --- a/haproxy.cfg +++ b/haproxy.cfg @@ -42,7 +42,7 @@ backend dockerbackend frontend dockerfrontend bind :2375 http-request deny unless METH_GET || { env(POST) -m bool } - http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/containers/[^/]+/((stop)|(restart)|(kill)) } { env(ALLOW_RESTARTS) -m bool } + http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/containers/[a-zA-Z0-9_.-]+/((stop)|(restart)|(kill)) } { env(ALLOW_RESTARTS) -m bool } http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/auth } { env(AUTH) -m bool } http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/build } { env(BUILD) -m bool } http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/commit } { env(COMMIT) -m bool }