Escaping logic in pg_dump_command option breaks on spaces #822

New Issue

Closed

opened 2024-01-30 19:03:05 +00:00 by witten · 2 comments

witten commented 2024-01-30 19:03:05 +00:00

Owner

Copy Link

What I'm trying to do and why

Broken off from #810 discussion:

When using a command in the pg_dump_command option that contains spaces, the new escaping logic added as part of #810 causes an invalid command to be executed.

Steps to reproduce

Configure an option value for pg_dump_command similar to the example:

pg_dump_command: podman exec postgresql pg_dumpall

Then run a create action.

Actual behavior

Jan 29 20:57:12 compendium borgmatic[98093]: INFO borgbase-databases: Creating archive
Jan 29 20:57:12 compendium borgmatic[98093]: INFO ssh://<snip>.repo.borgbase.com/./repo: Dumping PostgreSQL databases
Jan 29 20:57:14 compendium borgmatic[98093]: INFO Creating archive at "ssh://<snip>.repo.borgbase.com/./repo::compendium-2024-01-29T20:57:12.842636"
Jan 29 20:57:14 compendium borgmatic[98093]: INFO Remote: Storage quota: 87.63 MB out of 10.00 GB used.
Jan 29 20:57:14 compendium borgmatic[98093]: INFO Remote: Storage quota: 87.63 MB out of 10.00 GB used.
Jan 29 20:57:15 compendium borgmatic[98093]: ERROR /bin/sh: line 1: podman exec postgresql pg_dumpall: command not found
Jan 29 20:57:15 compendium borgmatic[98093]: CRITICAL borgbase-databases: Error running actions for repository
Jan 29 20:57:15 compendium borgmatic[98093]: CRITICAL Command ''podman exec postgresql pg_dumpall' --no-password --clean --if-exists --username postgres > /root/.borgmatic/postgresql_databases/localhost/all' returned non-zero exit status 127.
Jan 29 20:57:15 compendium borgmatic[98093]: CRITICAL /etc/borgmatic.d/databases.yaml: An error occurred
Jan 29 20:57:15 compendium borgmatic[98093]: CRITICAL
Jan 29 20:57:15 compendium borgmatic[98093]: CRITICAL summary:
Jan 29 20:57:15 compendium borgmatic[98093]: CRITICAL /etc/borgmatic.d/databases.yaml: An error occurred
Jan 29 20:57:15 compendium borgmatic[98093]: CRITICAL borgbase-databases: Error running actions for repository
Jan 29 20:57:15 compendium borgmatic[98093]: CRITICAL /bin/sh: line 1: podman exec postgresql pg_dumpall: command not found
Jan 29 20:57:15 compendium borgmatic[98093]: CRITICAL Command ''podman exec postgresql pg_dumpall' --no-password --clean --if-exists --username postgres > /root/.borgmatic/postgresql_databases/localhost/all' returned non-zero exit status 127.
Jan 29 20:57:15 compendium borgmatic[98093]: CRITICAL
Jan 29 20:57:15 compendium borgmatic[98093]: CRITICAL Need some help? https://torsion.org/borgmatic/#issues

Expected behavior

The pg_dump_command runs without error.

Other notes / implementation ideas

Probably a good idea to audit other database command options for similar breakage.

borgmatic version

1.8.7

borgmatic installation method

No response

Borg version

No response

Python version

No response

Database version (if applicable)

No response

Operating system and version

No response

### What I'm trying to do and why Broken off from #810 discussion: When using a command in the `pg_dump_command` option that contains spaces, the new escaping logic added as part of #810 causes an invalid command to be executed. ### Steps to reproduce Configure an option value for `pg_dump_command` similar to the example: ```yaml pg_dump_command: podman exec postgresql pg_dumpall ``` Then run a `create` action. ### Actual behavior ``` Jan 29 20:57:12 compendium borgmatic[98093]: INFO borgbase-databases: Creating archive Jan 29 20:57:12 compendium borgmatic[98093]: INFO ssh://<snip>.repo.borgbase.com/./repo: Dumping PostgreSQL databases Jan 29 20:57:14 compendium borgmatic[98093]: INFO Creating archive at "ssh://<snip>.repo.borgbase.com/./repo::compendium-2024-01-29T20:57:12.842636" Jan 29 20:57:14 compendium borgmatic[98093]: INFO Remote: Storage quota: 87.63 MB out of 10.00 GB used. Jan 29 20:57:14 compendium borgmatic[98093]: INFO Remote: Storage quota: 87.63 MB out of 10.00 GB used. Jan 29 20:57:15 compendium borgmatic[98093]: ERROR /bin/sh: line 1: podman exec postgresql pg_dumpall: command not found Jan 29 20:57:15 compendium borgmatic[98093]: CRITICAL borgbase-databases: Error running actions for repository Jan 29 20:57:15 compendium borgmatic[98093]: CRITICAL Command ''podman exec postgresql pg_dumpall' --no-password --clean --if-exists --username postgres > /root/.borgmatic/postgresql_databases/localhost/all' returned non-zero exit status 127. Jan 29 20:57:15 compendium borgmatic[98093]: CRITICAL /etc/borgmatic.d/databases.yaml: An error occurred Jan 29 20:57:15 compendium borgmatic[98093]: CRITICAL Jan 29 20:57:15 compendium borgmatic[98093]: CRITICAL summary: Jan 29 20:57:15 compendium borgmatic[98093]: CRITICAL /etc/borgmatic.d/databases.yaml: An error occurred Jan 29 20:57:15 compendium borgmatic[98093]: CRITICAL borgbase-databases: Error running actions for repository Jan 29 20:57:15 compendium borgmatic[98093]: CRITICAL /bin/sh: line 1: podman exec postgresql pg_dumpall: command not found Jan 29 20:57:15 compendium borgmatic[98093]: CRITICAL Command ''podman exec postgresql pg_dumpall' --no-password --clean --if-exists --username postgres > /root/.borgmatic/postgresql_databases/localhost/all' returned non-zero exit status 127. Jan 29 20:57:15 compendium borgmatic[98093]: CRITICAL Jan 29 20:57:15 compendium borgmatic[98093]: CRITICAL Need some help? https://torsion.org/borgmatic/#issues ``` ### Expected behavior The `pg_dump_command` runs without error. ### Other notes / implementation ideas Probably a good idea to audit other database command options for similar breakage. ### borgmatic version 1.8.7 ### borgmatic installation method _No response_ ### Borg version _No response_ ### Python version _No response_ ### Database version (if applicable) _No response_ ### Operating system and version _No response_

witten referenced this issue 2024-01-30 19:03:30 +00:00

Escape runtime variables in hooks #810

witten added the

bug

label 2024-01-30 19:51:21 +00:00

witten referenced this issue from a commit 2024-01-31 18:54:15 +00:00

Fix broken escaping logic for "pg_dump_command" (#822) + bonus shell injection fixes.

witten commented 2024-01-31 18:54:27 +00:00

Author

Owner

Copy Link

Fixed in main!

Fixed in main!

witten closed this issue 2024-01-31 18:54:27 +00:00

witten commented 2024-01-31 18:56:30 +00:00

Author

Owner

Copy Link

Released in borgmatic 1.8.8!

Released in borgmatic 1.8.8!

Sign in to join this conversation.

No Branch/Tag Specified

Branches Tags

main

2.0.4

2.0.3

2.0.2

2.0.1

2.0.0

1.9.14

1.9.13

1.9.12

1.9.11

1.9.10

1.9.9

1.9.8

1.9.7

1.9.6

1.9.5

1.9.4

1.9.3

1.9.2

1.9.1

1.9.0

1.8.14

1.8.13

1.8.12

1.8.11

1.8.10

1.8.9

1.8.8

1.8.7

1.8.6

1.8.5

1.8.4

1.8.3

1.8.2

1.8.1

1.8.0

1.7.15

1.7.14

1.7.13

1.7.12

1.7.11

1.7.10

1.7.9

1.7.8

1.7.7

1.7.6

1.7.5

1.7.4

1.7.3

1.7.2

1.7.1

1.7.0

1.6.6

1.6.5

1.6.4

1.6.3

1.6.2

1.6.1

1.6.0

1.5.24

1.5.23

1.5.22

1.5.21

1.5.20

1.5.19

1.5.18

1.5.17

1.5.16

1.5.15

1.5.14

1.5.13

1.5.12

1.5.11

1.5.10

1.5.9

1.5.8

1.5.7

1.5.7.dev0

1.5.6

1.5.5

1.5.4

1.5.3

1.5.2

1.5.1

1.5.0

1.4.22

1.4.21

1.4.20

1.4.19

1.4.18

1.4.17

1.4.16

1.4.15

1.4.14

1.4.13

1.4.12

1.4.11

1.4.10

1.4.9

1.4.8

1.4.7

1.4.6

1.4.5

1.4.4

1.4.3

1.4.2

1.4.1

1.4.0

1.3.26

1.3.25

1.3.24

1.3.23

1.3.22

1.3.21

1.3.20

1.3.19

1.3.18

1.3.17

1.3.16

1.3.15

1.3.14

1.3.13

1.3.12

1.3.11

1.3.10

1.3.9

1.3.8

1.3.7

1.3.6

1.3.5

1.3.4

1.3.3

1.3.2

1.3.1

1.3.0

1.2.18

1.2.17

1.2.16

1.2.15

1.2.14

1.2.13

1.2.12

1.2.11

1.2.10

1.2.9

1.2.8

1.2.7

1.2.6

1.2.5

1.2.4

1.2.3

1.2.2

1.2.1

1.2.0

1.1.15

1.1.14

1.1.13

1.1.12

1.1.11

1.1.10

1.1.9

1.1.7

1.1.6

1.1.5

1.1.4

1.1.3

1.1.2

1.1.1

1.1.0

1.0.3

1.0.2

1.0.1

1.0.0

0.1.8

0.1.7

0.1.6

0.1.5

0.1.4

0.1.3

0.1.2

0.1.1

0.1.0

0.0.7

0.0.6

0.0.5

0.0.4

0.0.3

0.0.2

Labels

Clear labels

blocked

bug

data loss

design finalized

good first issue

new feature area

question / support

security

waiting for response

No Label

bug

Milestone

No items

No Milestone

Assignees

Clear assignees

diivi import_bot witten

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: borgmatic-collective/borgmatic#822

No description provided.