- trim container image size - sanitize socktop inputs

docker/restricted-shell.sh

@@ -132,13 +132,35 @@ main() {
 
         case "$cmd" in
             socktop)
-                # Allow socktop with any arguments
+                # Allow socktop with validated arguments only
                 if [ "$cmd" = "$input" ]; then
                     # No arguments, use default (local profile)
                     /usr/bin/socktop -P local
                 else
-                    # Pass arguments to socktop
-                    /usr/bin/socktop $args
+                    # Validate and sanitize arguments to prevent command injection
+                    # Only allow: -P <profile_name> or ws://<url>
+
+                    # Check for profile argument (-P followed by safe profile name)
+                    if [[ "$args" =~ ^-P[[:space:]]+[a-zA-Z0-9_-]+$ ]]; then
+                        # Extract profile name and validate it
+                        profile=$(echo "$args" | sed 's/-P[[:space:]]\+//')
+                        /usr/bin/socktop -P "$profile"
+                    # Check for websocket URL (ws:// or wss://)
+                    elif [[ "$args" =~ ^wss?://[a-zA-Z0-9\.\:/_-]+$ ]]; then
+                        # Validate websocket URL format
+                        /usr/bin/socktop "$args"
+                    else
+                        # Reject anything else as potentially dangerous
+                        echo -e "${RED}Error:${NC} Invalid arguments for socktop"
+                        echo -e "${YELLOW}Allowed usage:${NC}"
+                        echo "  socktop              - Use default local profile"
+                        echo "  socktop -P <profile> - Use named profile (alphanumeric, dash, underscore only)"
+                        echo "  socktop <ws_url>     - Connect to websocket URL (ws:// or wss://)"
+                        echo ""
+                        echo -e "${YELLOW}Examples:${NC}"
+                        echo "  socktop -P rpi-master"
+                        echo "  socktop ws://192.168.1.100:3000"
+                    fi
                 fi
                 ;;
             help|--help|-h)