fix(env): validate Docker-compatible variable keys

Add shared environment variable key validation and normalization for Livewire forms and models, allowing Docker-compatible keys while rejecting invalid entries such as keys containing equals signs. Also quote Railpack build environment and secret arguments safely.
This commit is contained in:
Andras Bacsai committed 2026-05-11 15:43:09 +02:00
1 parent d5946dcfca
commit b5ff124446
11 files changed
+294 -57

No files matched your search

+2 -2
View File
@@ -2570,7 +2570,7 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
return 'env '.$variables
->map(function ($value, $key) {
return "{$key}=".escapeShellValue($value);
return escapeShellValue("{$key}={$value}");
})
->implode(' ').' ';
}
@@ -2583,7 +2583,7 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
return ' '.$variables
->map(function ($value, $key) {
return "--secret id={$key},env={$key}";
return '--secret '.escapeShellValue("id={$key},env={$key}");
})
->implode(' ');
}