fix: restrict backup restore paths

scripts/backup/restore-path-assertions.sh

@@ -0,0 +1,181 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)"
+PROJECT_ROOT="$(cd -- "$SCRIPT_DIR/../.." && pwd -P)"
+RESTORE_SCRIPT="$PROJECT_ROOT/scripts/backup/restore.sh"
+TMP_ROOT="$(mktemp -d)"
+
+cleanup() {
+  rm -rf -- "$TMP_ROOT"
+}
+trap cleanup EXIT
+
+fail() {
+  printf 'ASSERTION FAILED: %s\n' "$*" >&2
+  exit 1
+}
+
+setup_fake_environment() {
+  local fake_bin="$TMP_ROOT/bin"
+
+  mkdir -p -- "$fake_bin" "$TMP_ROOT/mount" "$TMP_ROOT/staging"
+  printf 'not-secret\n' > "$TMP_ROOT/restic-password"
+
+  cat > "$fake_bin/docker" <<'EOF'
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+printf '%s\t' "$@" >> "$DRAGONS_STASH_DOCKER_CALLS"
+printf '\n' >> "$DRAGONS_STASH_DOCKER_CALLS"
+
+target=""
+previous=""
+safety_output_host=""
+safety_archive=""
+for argument in "$@"; do
+  if [[ "$previous" == "--target" ]]; then
+    target="$argument"
+  fi
+  if [[ "$previous" == "-v" && "$argument" == *":/safety-output" ]]; then
+    safety_output_host="${argument%:/safety-output}"
+  fi
+  if [[ "$argument" == /safety-output/pre-restore-*.tar ]]; then
+    safety_archive="${argument#/safety-output/}"
+  fi
+  previous="$argument"
+done
+
+if [[ "${1:-}" == "compose" && "${2:-}" == "config" && "${3:-}" == "--format" && "${4:-}" == "json" ]]; then
+  printf '{\n  "name": "dragonsstash"\n}\n'
+  exit 0
+fi
+
+if [[ "${1:-}" == "volume" && "${2:-}" == "ls" ]]; then
+  if [[ " $* " == *"com.docker.compose.volume=tdlib_state"* ]]; then
+    printf 'dragonsstash_tdlib_state\n'
+  elif [[ " $* " == *"com.docker.compose.volume=tdlib_bot_state"* ]]; then
+    printf 'dragonsstash_tdlib_bot_state\n'
+  fi
+  exit 0
+fi
+
+if [[ " $* " == *" exec -T db pg_dump "* ]]; then
+  printf 'custom dump\n'
+  exit 0
+fi
+
+if [[ " $* " == *" backup restore "* ]]; then
+  if [[ "$target" != /staging/* ]]; then
+    printf 'Unexpected restore target: %s\n' "$target" >&2
+    exit 1
+  fi
+
+  host_target="$BACKUP_STAGING_PATH/${target#/staging/}"
+  mkdir -p \
+    "$host_target/staging/backup-legacy/manifest" \
+    "$host_target/data/tdlib-worker" \
+    "$host_target/data/tdlib-bot"
+  printf 'custom dump\n' > "$host_target/staging/backup-legacy/database.dump"
+  printf '{}\n' > "$host_target/staging/backup-legacy/manifest/backup-manifest.json"
+
+  if [[ "${RESTORE_ASSERT_CREATE_UNEXPECTED:-0}" == "1" ]]; then
+    mkdir -p "$host_target/data/uploads" "$host_target/data/tmp-zips" "$host_target/data/postgres"
+  fi
+fi
+
+if [[ -n "$safety_output_host" && -n "$safety_archive" ]]; then
+  printf 'archive\n' > "$safety_output_host/$safety_archive"
+fi
+
+exit 0
+EOF
+  chmod +x "$fake_bin/docker"
+
+  cat > "$fake_bin/mountpoint" <<'EOF'
+#!/usr/bin/env bash
+set -Eeuo pipefail
+exit 0
+EOF
+  chmod +x "$fake_bin/mountpoint"
+
+  cat > "$fake_bin/curl" <<'EOF'
+#!/usr/bin/env bash
+set -Eeuo pipefail
+exit 0
+EOF
+  chmod +x "$fake_bin/curl"
+
+  export PATH="$fake_bin:$PATH"
+  export BACKUP_MOUNT_PATH="$TMP_ROOT/mount"
+  export BACKUP_STAGING_PATH="$TMP_ROOT/staging"
+  export BACKUP_RESTIC_PASSWORD_FILE="$TMP_ROOT/restic-password"
+  export BACKUP_REPOSITORY="/backup/restic"
+}
+
+run_restore_to_staging() {
+  local name="$1"
+  shift
+
+  DRAGONS_STASH_DOCKER_CALLS="$TMP_ROOT/docker-calls-$name.log" \
+    "$@" "$RESTORE_SCRIPT" restore-to-staging snapshot-scope "$TMP_ROOT/staging/$name"
+}
+
+run_restore_live() {
+  local name="$1"
+  shift
+
+  DRAGONS_STASH_DOCKER_CALLS="$TMP_ROOT/docker-calls-$name.log" \
+    "$@" "$RESTORE_SCRIPT" restore-live snapshot-scope --confirm-replace-live-data
+}
+
+assert_restore_call_is_filtered() {
+  local calls="$1"
+  local restore_call
+
+  restore_call="$(grep $'backup\trestore\tsnapshot-scope' "$calls" || true)"
+  [[ -n "$restore_call" ]] || fail "restore command was not invoked"
+  [[ "$restore_call" == *$'--include\t/staging/backup-*/database.dump'* ]] || fail "database dump include filter missing"
+  [[ "$restore_call" == *$'--include\t/staging/backup-*/manifest\t'* ]] || fail "manifest include filter missing"
+  [[ "$restore_call" == *$'--include\t/staging/backup-*/manifest/**'* ]] || fail "manifest subtree include filter missing"
+  [[ "$restore_call" == *$'--include\t/data/tdlib-worker\t'* ]] || fail "worker TDLib root include filter missing"
+  [[ "$restore_call" == *$'--include\t/data/tdlib-worker/**'* ]] || fail "worker TDLib subtree include filter missing"
+  [[ "$restore_call" == *$'--include\t/data/tdlib-bot\t'* ]] || fail "bot TDLib root include filter missing"
+  [[ "$restore_call" == *$'--include\t/data/tdlib-bot/**'* ]] || fail "bot TDLib subtree include filter missing"
+  [[ "$restore_call" != *"/data/uploads"* ]] || fail "restore includes uploads path"
+}
+
+assert_restore_uses_include_filters() {
+  local calls="$TMP_ROOT/docker-calls-safe.log"
+
+  setup_fake_environment
+  run_restore_to_staging safe bash >/dev/null
+
+  assert_restore_call_is_filtered "$calls"
+}
+
+assert_live_restore_uses_include_filters() {
+  local calls="$TMP_ROOT/docker-calls-live.log"
+
+  setup_fake_environment
+  run_restore_live live bash >/dev/null
+
+  assert_restore_call_is_filtered "$calls"
+}
+
+assert_unexpected_volume_content_is_rejected() {
+  local output="$TMP_ROOT/unexpected-output.log"
+
+  setup_fake_environment
+  if RESTORE_ASSERT_CREATE_UNEXPECTED=1 run_restore_to_staging unexpected bash >"$output" 2>&1; then
+    fail "restore accepted unexpected restored data volume content"
+  fi
+  grep -Eq 'Unexpected restored data volume content|Refusing restore' "$output" \
+    || fail "restore rejected unexpected content without an explicit guard message"
+}
+
+assert_restore_uses_include_filters
+assert_live_restore_uses_include_filters
+assert_unexpected_volume_content_is_rejected
+
+printf 'restore-path assertions passed\n'

scripts/backup/restore.sh

@@ -5,6 +5,15 @@ readonly CONFIRM_REPLACE_LIVE_DATA="--confirm-replace-live-data"
 readonly STAGING_CONTAINER_ROOT="/staging"
 readonly BACKUP_CONTAINER_ROOT="/backup"
 readonly -a LIVE_SERVICES=(app worker bot)
+readonly -a RESTORE_INCLUDE_FILTERS=(
+  --include "/staging/backup-*/database.dump"
+  --include "/staging/backup-*/manifest"
+  --include "/staging/backup-*/manifest/**"
+  --include "/data/tdlib-worker"
+  --include "/data/tdlib-worker/**"
+  --include "/data/tdlib-bot"
+  --include "/data/tdlib-bot/**"
+)
 
 RESTORED_DUMP=""
 RESTORED_TDLIB_WORKER=""
@@ -80,6 +89,13 @@ backup_restic() {
   docker compose --profile backup run --rm --no-deps backup "$@"
 }
 
+restore_snapshot_subset() {
+  local snapshot_id="$1"
+  local container_staging_dir="$2"
+
+  backup_restic restore "$snapshot_id" --target "$container_staging_dir" "${RESTORE_INCLUDE_FILTERS[@]}"
+}
+
 canonical_staging_root() {
   realpath -m -- "$BACKUP_STAGING_PATH"
 }
@@ -131,6 +147,48 @@ verify_custom_dump() {
     backup --list /restore/database.dump >/dev/null
 }
 
+reject_unexpected_restored_content() {
+  local staging_dir="$1"
+  local backup_directory="$2"
+  local entry
+  local name
+  local -a unexpected_entries=()
+
+  while IFS= read -r -d '' entry; do
+    name="$(basename -- "$entry")"
+    case "$name" in
+      data|staging) ;;
+      *) unexpected_entries+=("$entry") ;;
+    esac
+  done < <(find "$staging_dir" -mindepth 1 -maxdepth 1 -type d -print0)
+
+  if [[ -d "$staging_dir/data" ]]; then
+    while IFS= read -r -d '' entry; do
+      name="$(basename -- "$entry")"
+      case "$name" in
+        tdlib-worker|tdlib-bot) ;;
+        *) unexpected_entries+=("$entry") ;;
+      esac
+    done < <(find "$staging_dir/data" -mindepth 1 -maxdepth 1 -print0)
+  fi
+
+  while IFS= read -r -d '' entry; do
+    name="$(basename -- "$entry")"
+    case "$name" in
+      database.dump|manifest) ;;
+      *) unexpected_entries+=("$entry") ;;
+    esac
+  done < <(find "$backup_directory" -mindepth 1 -maxdepth 1 -print0)
+
+  if ((${#unexpected_entries[@]})); then
+    printf 'Refusing restore: unexpected restored data volume content found under %s:\n' "$staging_dir" >&2
+    for entry in "${unexpected_entries[@]}"; do
+      printf '  - %s\n' "${entry#"$staging_dir"/}" >&2
+    done
+    return 1
+  fi
+}
+
 validate_restored_tree() {
   local staging_dir="$1"
   local -a backup_directories=("$staging_dir"/staging/backup-*)
@@ -142,6 +200,7 @@ validate_restored_tree() {
     return 1
   fi
   backup_directory="${backup_directories[0]}"
+  reject_unexpected_restored_content "$staging_dir" "$backup_directory"
   RESTORED_DUMP="$backup_directory/database.dump"
   manifest="$backup_directory/manifest/backup-manifest.json"
   RESTORED_TDLIB_WORKER="$staging_dir/data/tdlib-worker"
@@ -169,7 +228,7 @@ restore_to_staging() {
   container_staging_dir="$(container_staging_directory "$staging_dir")"
   prepare_fresh_staging_directory "$staging_dir"
   verify_snapshot "$snapshot_id"
-  backup_restic restore "$snapshot_id" --target "$container_staging_dir"
+  restore_snapshot_subset "$snapshot_id" "$container_staging_dir"
   validate_restored_tree "$staging_dir"
   printf 'Staging restore verified: %s\n' "$staging_dir"
 }
@@ -327,7 +386,7 @@ restore_live() {
   LIVE_RESTORE_ACTIVE=1
   docker compose --profile full stop "${LIVE_SERVICES[@]}"
   create_safety_dump
-  backup_restic restore "$snapshot_id" --target "$container_staging_dir"
+  restore_snapshot_subset "$snapshot_id" "$container_staging_dir"
   validate_restored_tree "$LIVE_STAGING_DIR"
   worker_volume="$(compose_volume_name "$project_name" tdlib_state)"
   bot_volume="$(compose_volume_name "$project_name" tdlib_bot_state)"