c5fbf78bd8
fix(database): quote S3 restore temp paths
...
Escape generated restore file paths before composing docker and shell cleanup commands so paths with spaces or metacharacters cannot break command execution. Update import form security coverage to target ImportForm directly.
2026-05-29 12:27:33 +02:00
9113ed714f
feat: add validation methods for S3 bucket names, paths, and server paths; update import logic to prevent command injection
2025-11-25 16:40:35 +01:00
fbdd8e5f03
fix: improve robustness and security in database restore flows
...
- Add null checks for server instances in restore events to prevent errors
- Escape S3 credentials to prevent command injection vulnerabilities
- Fix file upload clearing custom location to prevent UI confusion
- Optimize isSafeTmpPath helper by avoiding redundant dirname calls
- Remove unnecessary --rm flag from long-running S3 restore container
- Prioritize uploaded files over custom location in import logic
- Add comprehensive unit tests for restore event null server handling
🤖 Generated with [Claude Code](https://claude.com/claude-code )
Co-Authored-By: Claude <noreply@anthropic.com >
2025-11-17 14:13:10 +01:00
Andras Bacsai