codeninjasllc/discourse
1
0
Fork 0
mirror of https://github.com/codeninjasllc/discourse.git synced 2024-11-23 15:48:43 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

SECUIRTY: Escape input made to system calls.

Browse source
This commit is contained in:
Guo Xiang Tan 2016-09-16 10:32:53 +08:00
parent 8f36290c05
commit f63a797e39
3 changed files with 30 additions and 28 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

24
lib/backup_restore/backuper.rb
View file

@ -199,8 +199,8 @@ module BackupRestore
log "Finalizing database dump file: #{@backup_filename}"
execute_command(
"mv #{@dump_filename} #{File.join(@archive_directory, @backup_filename)}",
"Failed to move database dump file."
'mv', @dump_filename, File.join(@archive_directory, @backup_filename),
failure_message: "Failed to move database dump file."
)
remove_tmp_directory
@ -212,17 +212,17 @@ module BackupRestore
tar_filename = "#{@archive_basename}.tar"
log "Making sure archive does not already exist..."
execute_command("rm -f #{tar_filename}")
execute_command("rm -f #{tar_filename}.gz")
execute_command('rm', '-f', tar_filename)
execute_command('rm', '-f', "#{tar_filename}.gz")
log "Creating empty archive..."
execute_command("tar --create --file #{tar_filename} --files-from /dev/null")
execute_command('tar', '--create', '--file', tar_filename, '--files-from', '/dev/null')
log "Archiving data dump..."
FileUtils.cd(File.dirname("#{@dump_filename}")) do
FileUtils.cd(File.dirname(@dump_filename)) do
execute_command(
"tar --append --dereference --file #{tar_filename} #{File.basename(@dump_filename)}",
"Failed to archive data dump."
'tar', '--append', '--dereference', '--file', tar_filename, File.basename(@dump_filename),
failure_message: "Failed to archive data dump."
)
end
@ -232,8 +232,8 @@ module BackupRestore
FileUtils.cd(File.join(Rails.root, "public")) do
if File.directory?(upload_directory)
execute_command(
"tar --append --dereference --file #{tar_filename} #{upload_directory}",
"Failed to archive uploads."
'tar', '--append', '--dereference', '--file', tar_filename, upload_directory,
failure_message: "Failed to archive uploads."
)
else
log "No uploads found, skipping archiving uploads..."
@ -243,7 +243,7 @@ module BackupRestore
remove_tmp_directory
log "Gzipping archive, this may take a while..."
execute_command("gzip -5 #{tar_filename}", "Failed to gzip archive.")
execute_command('gzip', '-5', tar_filename, failure_message: "Failed to gzip archive.")
end
def after_create_hook
@ -277,7 +277,7 @@ module BackupRestore
def remove_tar_leftovers
log "Removing '.tar' leftovers..."
`rm -f #{@archive_directory}/*.tar`
system('rm', '-f', "#{@archive_directory}/*.tar")
end
def remove_tmp_directory

22
lib/backup_restore/restorer.rb
View file

@ -115,7 +115,7 @@ module BackupRestore
# For backwards compatibility
@dump_filename =
if @is_archive
if system("tar --list --file #{@source_filename} #{BackupRestore::OLD_DUMP_FILE}")
if system('tar', '--list', '--file', @source_filename, BackupRestore::OLD_DUMP_FILE)
File.join(@tmp_directory, BackupRestore::OLD_DUMP_FILE)
else
File.join(@tmp_directory, BackupRestore::DUMP_FILE)
@ -176,7 +176,7 @@ module BackupRestore
def copy_archive_to_tmp_directory
log "Copying archive to tmp directory..."
execute_command("cp '#{@source_filename}' '#{@archive_filename}'", "Failed to copy archive to tmp directory.")
execute_command('cp', @source_filename, @archive_filename, failure_message: "Failed to copy archive to tmp directory.")
end
def unzip_archive
@ -185,7 +185,7 @@ module BackupRestore
log "Unzipping archive, this may take a while..."
FileUtils.cd(@tmp_directory) do
execute_command("gzip --decompress '#{@archive_filename}'", "Failed to unzip archive.")
execute_command('gzip', '--decompress', @archive_filename, failure_message: "Failed to unzip archive.")
end
end
@ -193,11 +193,11 @@ module BackupRestore
log "Extracting metadata file..."
@metadata =
if system("tar --list --file #{@source_filename} #{BackupRestore::METADATA_FILE}")
if system('tar', '--list', '--file', @source_filename, BackupRestore::METADATA_FILE)
FileUtils.cd(@tmp_directory) do
execute_command(
"tar --extract --file '#{@tar_filename}' #{BackupRestore::METADATA_FILE}",
"Failed to extract metadata file."
'tar', '--extract', '--file', @tar_filename, BackupRestore::METADATA_FILE,
failure_message: "Failed to extract metadata file."
)
end
@ -232,8 +232,8 @@ module BackupRestore
FileUtils.cd(@tmp_directory) do
execute_command(
"tar --extract --file '#{@tar_filename}' #{File.basename(@dump_filename)}",
"Failed to extract dump file."
'tar', '--extract', '--file', @tar_filename, File.basename(@dump_filename),
failure_message: "Failed to extract dump file."
)
end
end
@ -292,7 +292,7 @@ module BackupRestore
"--dbname='#{db_conf.database}'", # connect to database *dbname*
"--single-transaction", # all or nothing (also runs COPY commands faster)
host_argument, # the hostname to connect to (if any)
port_argument, # the port to connect to (if any)
port_argument, # the port to connect to (if any)
username_argument # the username to connect as (if any)
].join(" ")
end
@ -362,8 +362,8 @@ module BackupRestore
log "Extracting uploads..."
FileUtils.cd(File.join(Rails.root, "public")) do
execute_command(
"tar --extract --keep-newer-files --file '#{@tar_filename}' uploads/",
"Failed to extract uploads."
'tar', '--extract', '--keep-newer-files', '--file', @tar_filename, 'uploads/',
failure_message: "Failed to extract uploadsd."
)
end
end

12
lib/backup_restore/utils.rb
View file

@ -1,14 +1,16 @@
require 'open3'
module BackupRestore
module Utils
def execute_command(command, failure_message = "")
output = `#{command} 2>&1`
def execute_command(*command, failure_message: "")
stdout, stderr, status = Open3.capture3(*command)
if !$?.success?
if !status.success?
failure_message = "#{failure_message}\n" if !failure_message.blank?
raise "#{failure_message}#{output}"
raise "#{failure_message}#{stderr}"
end
output
stdout
end
def pretty_logs(logs)