Wrap S3 credential flags (getS3Credentials + destination.testConnection), the
listBackupFiles search path, and every restore backupPath/backupFile with
shell-quote's quote() so $(), backticks, quotes and spaces in destination
fields or backupFile can no longer break out of the rclone shell commands.
The backup and restore command builders interpolated database name / user /
password directly into a 'docker exec ... {bash,sh} -c "..."' string executed
via execAsync / execAsyncRemote. Because the values sit inside the outer shell's
double quotes, a simple quote() is insufficient: the outer shell expands $(),
backticks and $VAR before the inner quoting applies (double-nested shell).
Values are now passed to the container as environment variables (docker exec -e
VAR=<shell-quoted>) and referenced as "$VAR" inside a single-quoted inner
script, so they never enter the inner command text and cannot break out of
either shell layer. The rest of each command (pg_dump/mysqldump/etc., flags,
| gzip) is unchanged.
Closes GHSA-qc73-mp78-4833, GHSA-qf8x-98cv-92qh, GHSA-ww4j-wjrr-rq8v, GHSA-7m3w-rm5f-h4fr, GHSA-f7mp-9jfp-mjrr
- Modified the restore command functions for PostgreSQL, MariaDB, MySQL, and MongoDB to ensure that database user credentials are enclosed in single quotes. This change enhances command execution reliability and prevents potential issues with special characters in usernames and passwords.
- Added `apiRestoreBackup` schema to define input requirements for restore operations.
- Refactored restore utilities for PostgreSQL, MySQL, MariaDB, and MongoDB to utilize a unified command generation approach, enhancing maintainability.
- Improved logging during restore processes to provide clearer feedback on command execution and success/failure states.
- Streamlined the handling of database credentials and backup file paths across different database types, ensuring consistency and reducing redundancy.
- Updated the RestoreBackupSchema to require serviceName for compose backups, improving validation and user feedback.
- Refactored the ShowBackups component to include deployment information, enhancing the user interface and experience.
- Introduced new SQL migration files to add backupId to the deployment table and appName to the backup table, improving data relationships and integrity.
- Enhanced deployment creation logic to support backup deployments, ensuring better tracking and management of backup processes.
- Improved backup and restore utility functions to streamline command execution and error handling during backup operations.
Mauricio Siu