From ce1202bff1e2b737484aac1ce4e49d0845230a77 Mon Sep 17 00:00:00 2001
From: kiddin9 <48883331+kiddin9@users.noreply.github.com>
Date: Mon, 21 Sep 2026 01:40:58 +0800
Subject: [PATCH] Update dockerman.patch

---
 .github/diy/patches/dockerman.patch | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/.github/diy/patches/dockerman.patch b/.github/diy/patches/dockerman.patch
index 8e68dc8dd..e5892a822 100644
--- a/.github/diy/patches/dockerman.patch
+++ b/.github/diy/patches/dockerman.patch
@@ -451,3 +451,22 @@
  	}
  
  	return {
+
+--- a/luci-app-dockerman/root/usr/share/rpcd/ucode/docker_rpc.uc
++++ b/luci-app-dockerman/root/usr/share/rpcd/ucode/docker_rpc.uc
+@@ -316,6 +316,15 @@ function run_ttyd(request) {
+ 		return { error: 'Container ID is required' };
+ 	}
+ 
++	// Strictly validate all user-supplied values before they are interpolated
++	// into a shell command string to prevent command injection.
++	if (!match(id, /^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/) ||
++	    !match(`${port}`, /^[0-9]{1,5}$/) || int(port) < 1 || int(port) > 65535 ||
++	    (uid && !match(`${uid}`, /^[a-zA-Z0-9_-]+$/)) ||
++	    !match(cmd, /^[a-zA-Z0-9_\/.\- ]+$/)) {
++		return { error: 'Invalid parameter supplied' };
++	}
++
+ 	let ttyd_cmd = `ttyd -q -d 2 --once --writable -p ${port} docker`;
+ 	const sock_addr = ds.get_socket_dest();
+