Max Kotliar 710c920d60 app/vmrestore: disallow restoring parts outside the configured -storageDataPath directory (#1051) ...

A specifically crafted backup source (compromised S3/GCS/Azure bucket) could use `..`
components in object names to write files outside the `-storageDataPath`
directory.

Fix by validating all source parts against the destination directory
before restore begins (restore.go), and adding a defense-in-depth panic
guard in `NewDirectWriteCloser` (fslocal.go).

PR https://github.com/VictoriaMetrics/VictoriaMetrics-enterprise/pull/1051

Co-authored-by: Roman Khavronenko <roman@victoriametrics.com>

2026-06-18 13:21:12 +03:00

..

bandwidth_limiter.go

all: run go fix -minmax

2026-02-18 19:24:27 +01:00

fslocal_test.go

lib/backup/fslocal: remove traling slash in provided directory (#10825)

2026-05-12 18:11:47 +03:00

fslocal.go

app/vmrestore: disallow restoring parts outside the configured -storageDataPath directory (#1051)

2026-06-18 13:21:12 +03:00

prealloc_linux.go

lib/backup: speed up restores on linuxsystems (#10661)

2026-03-27 07:35:44 +02:00

prealloc_other.go

lib/backup: speed up restores on linuxsystems (#10661)

2026-03-27 07:35:44 +02:00