From d83061786ca6bbe0a1ac90e4580b28d12806ad35 Mon Sep 17 00:00:00 2001 From: mrhid6 Date: Mon, 7 Sep 2026 14:45:37 +0000 Subject: [PATCH] fix: validate manifest collection names and route archive accessors through safeJoin --- shared/backup/archive.go | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/shared/backup/archive.go b/shared/backup/archive.go index 1d83e57..752111b 100644 --- a/shared/backup/archive.go +++ b/shared/backup/archive.go @@ -201,7 +201,7 @@ func (r *Reader) loadManifest() error { func (r *Reader) verifyMembers() error { for _, c := range r.manifest.Collections { - f, err := os.Open(filepath.Join(r.dir, collectionMember(c.Name))) + f, err := r.OpenCollection(c.Name) if err != nil { return fmt.Errorf("%w: %s is named in the manifest but absent from the archive", ErrChecksum, c.Name) @@ -227,14 +227,22 @@ func (r *Reader) Manifest() Manifest { return r.manifest } // OpenCollection returns the raw BSON stream for one collection. func (r *Reader) OpenCollection(name string) (io.ReadCloser, error) { - return os.Open(filepath.Join(r.dir, collectionMember(name))) + p, err := safeJoin(r.dir, collectionMember(name)) + if err != nil { + return nil, err + } + return os.Open(p) } // IndexesJSON returns a collection's index specifications, or nil when the // archive holds none. A collection with no indexes beyond _id_ is ordinary and // is not an error. func (r *Reader) IndexesJSON(name string) ([]byte, error) { - raw, err := os.ReadFile(filepath.Join(r.dir, indexMember(name))) + p, err := safeJoin(r.dir, indexMember(name)) + if err != nil { + return nil, err + } + raw, err := os.ReadFile(p) if os.IsNotExist(err) { return nil, nil }