Repository navigation
security: reject path traversal and non-regular entries when extracting remote backup archives - #1626
Merged
Slach merged 3 commits intoOct 20, 2026
Conversation
Older archives may contain tar directory entries; create the directory (under the same containment check) and skip, instead of aborting.
Coverage Report for CI Build 39281711786Coverage decreased (-2.6%) to 67.798%Details
Uncovered Changes
Coverage Regressions776 previously-covered lines in 21 files lost coverage.
Coverage Stats
💛 - Coveralls |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
DownloadCompressedStreamextracts remote backup archives with:The archive entry name is used without any validation, so an entry crafted with
../segments (tar-slip / CWE-22) resolves outsidelocalPath, andos.Createthen writes attacker-chosen paths on the ClickHouse host. Non-regular entries (symlinks/hardlinks) are also honored, which opens the usual link-following variant of the same attack.Threat model
This code path runs during
restore/download(incl. the API server's/backup/download/{name}and/backup/restore/{name}), extracting archives that come from the configured remote storage. Anyone who can tamper with the backup bucket — compromised storage credentials, a malicious insider, or a MITM when the remote is plaintext FTP — can plant a crafted archive and get arbitrary file writes on the database server, which typically runs as root in the container image.Archive integrity is exactly the trust boundary an extractor should defend, so this hardens the extractor instead of relying on the storage being benign.
Fix
safeExtractPath()helper that rejects any entry whose cleaned path escapeslocalPath.tar.TypeSymlink,tar.TypeLink, etc.) instead of extracting them.store/some db/...-style names used for data parts) and traversal payloads.Notes