fix(service-apps): harden updates and docker commands

Escape service application lifecycle command arguments for deploy, restart, stop, and log status checks.
Validate API update payloads from JSON/form data before applying allowed fields, preserving explicit boolean and null values.
Add coverage for service application API authorization, team isolation, validation, and command escaping.

app/Actions/Service/DeployServiceApplication.php

@@ -22,35 +22,42 @@ class DeployServiceApplication
         $service->isConfigurationChanged(save: true);
 
         $workdir = $service->workdir();
+        $composeFile = "{$workdir}/docker-compose.yml";
+        $safeWorkdir = escapeshellarg($workdir);
+        $safeComposeFile = escapeshellarg($composeFile);
+        $safeProjectName = escapeshellarg($service->uuid);
+        $safeComposeServiceName = escapeshellarg($composeServiceName);
+
         $commands = collect([
-            "echo 'Saved configuration files to {$workdir}.'",
-            "touch {$workdir}/.env",
+            'echo '.escapeshellarg("Saved configuration files to {$workdir}."),
+            'touch '.escapeshellarg("{$workdir}/.env"),
         ]);
 
         if ($pullLatestImages) {
             $commands->push('echo Pulling image for service.');
-            $commands->push("docker compose --project-directory {$workdir} -f {$workdir}/docker-compose.yml --project-name {$service->uuid} pull {$composeServiceName}");
+            $commands->push("docker compose --project-directory {$safeWorkdir} -f {$safeComposeFile} --project-name {$safeProjectName} pull {$safeComposeServiceName}");
         }
 
         if ($service->networks()->count() > 0) {
             $commands->push('echo Creating Docker network.');
-            $commands->push("docker network inspect {$service->uuid} >/dev/null 2>&1 || docker network create --attachable {$service->uuid}");
+            $commands->push("docker network inspect {$safeProjectName} >/dev/null 2>&1 || docker network create --attachable {$safeProjectName}");
         }
 
-        $upCommand = "docker compose --project-directory {$workdir} -f {$workdir}/docker-compose.yml --project-name {$service->uuid} up -d --no-deps";
+        $upCommand = "docker compose --project-directory {$safeWorkdir} -f {$safeComposeFile} --project-name {$safeProjectName} up -d --no-deps";
         if ($forceRebuild) {
             $upCommand .= ' --build';
         }
-        $upCommand .= " {$composeServiceName}";
+        $upCommand .= " {$safeComposeServiceName}";
         $commands->push('echo Starting service container.');
         $commands->push($upCommand);
 
-        $commands->push("docker network connect {$service->uuid} coolify-proxy >/dev/null 2>&1 || true");
+        $commands->push("docker network connect {$safeProjectName} coolify-proxy >/dev/null 2>&1 || true");
 
         if (data_get($service, 'connect_to_docker_network')) {
-            $compose = data_get($service, 'docker_compose', []);
-            $network = $service->destination->network;
-            $commands->push("docker network connect --alias {$composeServiceName}-{$service->uuid} {$network} {$composeServiceName}-{$service->uuid} >/dev/null 2>&1 || true");
+            $network = escapeshellarg($service->destination->network);
+            $containerName = escapeshellarg("{$composeServiceName}-{$service->uuid}");
+            $networkAlias = escapeshellarg("{$composeServiceName}-{$service->uuid}");
+            $commands->push("docker network connect --alias {$networkAlias} {$network} {$containerName} >/dev/null 2>&1 || true");
         }
 
         return remote_process($commands->toArray(), $service->server, type_uuid: $service->uuid, callEventOnFinish: 'ServiceStatusChanged');

app/Actions/Service/RestartServiceApplication.php

@@ -15,7 +15,7 @@ class RestartServiceApplication
     {
         $service = $serviceApplication->service;
         $server = $service->destination->server;
-        $containerName = $serviceApplication->name.'-'.$service->uuid;
+        $containerName = escapeshellarg($serviceApplication->name.'-'.$service->uuid);
 
         instant_remote_process([
             "docker restart {$containerName}",

app/Actions/Service/StopServiceApplication.php

@@ -15,7 +15,7 @@ class StopServiceApplication
     {
         $service = $serviceApplication->service;
         $server = $service->destination->server;
-        $containerName = $serviceApplication->name.'-'.$service->uuid;
+        $containerName = escapeshellarg($serviceApplication->name.'-'.$service->uuid);
 
         instant_remote_process([
             "docker stop {$containerName}",

app/Actions/Service/UpdateServiceApplicationFromApi.php

@@ -9,12 +9,12 @@ use Illuminate\Http\Request;
 
 class UpdateServiceApplicationFromApi
 {
-    public function execute(ServiceApplication $serviceApplication, Request $request, string $teamId): ?JsonResponse
+    public function execute(ServiceApplication $serviceApplication, Request $request, string $teamId, array $payload): ?JsonResponse
     {
         $forceDomainOverride = $request->boolean('force_domain_override');
 
-        if ($request->has('url')) {
-            $urlRaw = $request->input('url');
+        if (array_key_exists('url', $payload)) {
+            $urlRaw = $payload['url'];
             if ($urlRaw !== null && ! is_string($urlRaw)) {
                 return response()->json([
                     'message' => 'Validation failed.',
@@ -59,38 +59,38 @@ class UpdateServiceApplicationFromApi
             $serviceApplication->fqdn = $parsed['normalized'];
         }
 
-        if ($request->has('human_name')) {
-            $serviceApplication->human_name = $request->input('human_name');
+        if (array_key_exists('human_name', $payload)) {
+            $serviceApplication->human_name = $payload['human_name'];
         }
 
-        if ($request->has('description')) {
-            $serviceApplication->description = $request->input('description');
+        if (array_key_exists('description', $payload)) {
+            $serviceApplication->description = $payload['description'];
         }
 
-        if ($request->has('image')) {
-            $serviceApplication->image = $request->input('image');
+        if (array_key_exists('image', $payload)) {
+            $serviceApplication->image = $payload['image'];
         }
 
-        if ($request->has('exclude_from_status')) {
-            $serviceApplication->exclude_from_status = $request->boolean('exclude_from_status');
+        if (array_key_exists('exclude_from_status', $payload)) {
+            $serviceApplication->exclude_from_status = filter_var($payload['exclude_from_status'], FILTER_VALIDATE_BOOLEAN);
         }
 
-        if ($request->has('is_gzip_enabled')) {
-            $serviceApplication->is_gzip_enabled = $request->boolean('is_gzip_enabled');
+        if (array_key_exists('is_gzip_enabled', $payload)) {
+            $serviceApplication->is_gzip_enabled = filter_var($payload['is_gzip_enabled'], FILTER_VALIDATE_BOOLEAN);
         }
 
-        if ($request->has('is_stripprefix_enabled')) {
-            $serviceApplication->is_stripprefix_enabled = $request->boolean('is_stripprefix_enabled');
+        if (array_key_exists('is_stripprefix_enabled', $payload)) {
+            $serviceApplication->is_stripprefix_enabled = filter_var($payload['is_stripprefix_enabled'], FILTER_VALIDATE_BOOLEAN);
         }
 
-        if ($request->has('is_log_drain_enabled')) {
-            $enabled = $request->boolean('is_log_drain_enabled');
+        if (array_key_exists('is_log_drain_enabled', $payload)) {
+            $enabled = filter_var($payload['is_log_drain_enabled'], FILTER_VALIDATE_BOOLEAN);
             $server = $serviceApplication->service->destination->server;
             if ($enabled && ! $server->isLogDrainEnabled()) {
                 return response()->json([
                     'message' => 'Validation failed.',
                     'errors' => [
-                        'is_log_drain_enabled' => 'Log drain is not enabled on the server for this service.',
+                        'is_log_drain_enabled' => ['Log drain is not enabled on the server for this service.'],
                     ],
                 ], 422);
             }

app/Http/Controllers/Api/ServiceApplicationsController.php

@@ -306,6 +306,11 @@ class ServiceApplicationsController extends Controller
 
         $this->authorize('update', $serviceApplication);
 
+        $payload = $request->json()->all();
+        if (empty($payload)) {
+            $payload = $request->request->all();
+        }
+
         $allowedFields = [
             'url',
             'human_name',
@@ -328,9 +333,9 @@ class ServiceApplicationsController extends Controller
             'is_stripprefix_enabled' => 'sometimes|boolean',
         ];
 
-        $validator = Validator::make($request->all(), $validationRules);
+        $validator = Validator::make($payload, $validationRules);
 
-        $extraFields = array_diff(array_keys($request->all()), $allowedFields);
+        $extraFields = array_diff(array_keys($payload), $allowedFields);
         if ($validator->fails() || ! empty($extraFields)) {
             $errors = $validator->errors();
             foreach ($extraFields as $field) {
@@ -343,7 +348,7 @@ class ServiceApplicationsController extends Controller
             ], 422);
         }
 
-        $response = $updateServiceApplicationFromApi->execute($serviceApplication, $request, $teamId);
+        $response = $updateServiceApplicationFromApi->execute($serviceApplication, $request, $teamId, $payload);
         if ($response instanceof JsonResponse) {
             return $response;
         }
@@ -450,8 +455,9 @@ class ServiceApplicationsController extends Controller
         }
 
         $containerName = $serviceApplication->name.'-'.$serviceApplication->service->uuid;
+        $safeContainerName = escapeshellarg($containerName);
 
-        $status = getContainerStatus($server, $containerName);
+        $status = getContainerStatus($server, $safeContainerName);
         if ($status !== 'running') {
             return response()->json([
                 'message' => 'Service application container is not running.',