Pass db backup/restore identifiers via env vars to avoid injection
fix(security): pass db backup/restore identifiers via env vars to avoid injection
Pass db backup/restore identifiers via env vars to avoid injectionccd2e8-fix-pass-db-backup-restore-identifiers-via-cve-2026-72733-cve-2026-72869fixpass backup restore identifiers via env
Committed by Siumauricio
commit message
fix(security): pass db backup/restore identifiers via env vars to avoid injection
The backup and restore command builders interpolated database name / user /
password directly into a 'docker exec ... {bash,sh} -c "..."' string executed
via execAsync / execAsyncRemote. Because the values sit inside the outer shell's
double quotes, a simple quote() is insufficient: the outer shell expands $(),
backticks and $VAR before the inner quoting applies (double-nested shell).
Values are now passed to the container as environment variables (docker exec -e
VAR=<shell-quoted>) and referenced as "$VAR" inside a single-quoted inner
script, so they never enter the inner command text and cannot break out of
either shell layer. The rest of each command (pg_dump/mysqldump/etc., flags,
| gzip) is unchanged.
Closes GHSA-qc73-mp78-4833, GHSA-qf8x-98cv-92qh, GHSA-ww4j-wjrr-rq8v, GHSA-7m3w-rm5f-h4fr, GHSA-f7mp-9jfp-mjrrEditor assessment
This commit patches CVE-2026-72733 and CVE-2026-72869. The subject is an exemplary statement of fix and reason: pass identifiers via env vars to avoid injection, with scope security. The body explains why ordinary quoting failed, because values sat inside an outer double-quoted shell string that expanded command substitutions before inner quoting applied, a double-nested shell. It then describes the remediation, environment variables referenced inside a single-quoted inner script, and notes the rest of each command is unchanged. Five GHSA references are collected in one Closes footer. Strong technical teaching.