Mauricio Siu d629faebc6 fix(security): validate volumeName and escape volume-backup file names ...

Add VOLUME_NAME_REGEX (Docker volume-name format) and enforce it on volumeName in
create/update/runManually — a legit volume name never contains shell metacharacters,
so this blocks injection across every docker run/rm/rclone sink at once. Escape the
user-supplied backupFileName and the mount volumeName in database rebuild with quote().

2026-07-20 16:45:55 -06:00

..

server

fix(security): validate volumeName and escape volume-backup file names

2026-07-20 16:45:55 -06:00