Affects:
0.4.0
Steps to reproduce
During repository scans/checks, the app executes restic with admin-configured SFTP settings.
Current behavior allows free-form command values in SFTP-related fields, which can cause execution paths beyond the intended read-only monitoring behavior.
This is not a classic Java shell-injection in ProcessBuilder, but it is still a security risk: user-supplied command strings are delegated to restic/ssh subprocess behavior.
Observed Risk Scenario
A malicious or compromised admin account configures SFTP_PASSWORD_COMMAND so it does more than printing a password (e.g., triggers additional shell logic before output).
Because scans/checks run automatically, this behavior can be executed repeatedly in scheduled jobs and may cause unintended operations against the repository/backend.
SFTP_COMMAND has similar risk because it is passed through as custom sftp.command without strict validation.
Expected Behavior
Repository configuration must not allow arbitrary command execution side effects.
Monitoring actions (snapshots, stats, check) should not permit hidden write/unsafe behavior via configuration fields.
Acceptance criteria
- Unsafe SFTP_PASSWORD_COMMAND/SFTP_COMMAND values are rejected server-side.
- Scheduled scan/check cannot execute arbitrary admin-provided shell logic.
- POST /repositories/save is confirmed admin-only by security config + test.
- Existing valid key-based SFTP use case remains supported.
- Documentation is updated to describe the supported secure SFTP configuration pattern.
Affects:
0.4.0
Steps to reproduce
During repository scans/checks, the app executes restic with admin-configured SFTP settings.
Current behavior allows free-form command values in SFTP-related fields, which can cause execution paths beyond the intended read-only monitoring behavior.
This is not a classic Java shell-injection in ProcessBuilder, but it is still a security risk: user-supplied command strings are delegated to restic/ssh subprocess behavior.
Observed Risk Scenario
A malicious or compromised admin account configures SFTP_PASSWORD_COMMAND so it does more than printing a password (e.g., triggers additional shell logic before output).
Because scans/checks run automatically, this behavior can be executed repeatedly in scheduled jobs and may cause unintended operations against the repository/backend.
SFTP_COMMAND has similar risk because it is passed through as custom sftp.command without strict validation.
Expected Behavior
Repository configuration must not allow arbitrary command execution side effects.
Monitoring actions (snapshots, stats, check) should not permit hidden write/unsafe behavior via configuration fields.
Acceptance criteria