Function validateFileNameFromBackup

src/Backups/BackupImpl.cpp:103–136

Validate that a file name from a backup does not contain path traversal sequences. This prevents a corrupted or tampered backup from accessing files outside the intended directories during restore.

    /// Validate that a file name from a backup does not contain path traversal sequences.
    /// This prevents a corrupted or tampered backup from accessing files outside the intended directories during restore.
    void validateFileNameFromBackup(const String & file_name, const String & field_name, const String & backup_name_for_logging)
    {
        fs::path path(file_name);

        /// Reject absolute or rooted paths.
        if (path.is_absolute() || path.has_root_name() || path.has_root_directory())
            throw Exception(
                ErrorCodes::INSECURE_PATH,
                "Backup {}: <{}> {} is an absolute path, which is not allowed",
                backup_name_for_logging,
                field_name,
                quoteString(file_name));

        /// Normalize the path and check that it does not escape the backup root.
        auto normalized = path.lexically_normal();

        /// Reject empty or degenerate paths.
        if (normalized.empty() || normalized == fs::path("."))
            throw Exception(
                ErrorCodes::BACKUP_DAMAGED,
                "Backup {}: <{}> {} is empty or invalid",
                backup_name_for_logging,
                field_name,
                quoteString(file_name));

        /// After normalization, a path that escapes the root starts with "..".
        if (*normalized.begin() == "..")
            throw Exception(
                ErrorCodes::INSECURE_PATH,
                "Backup {}: <{}> {} resolves to a path outside the backup, which is not allowed",
                backup_name_for_logging,
                field_name,
                quoteString(file_name));
    }
}