Harden backup and restore operations

internal/model/validate_test.go

@@ -118,3 +118,39 @@ func TestRsyncJobRejectsOverlappingPaths(t *testing.T) {
 		t.Fatal("rsync target inside source accepted")
 	}
 }
+
+func TestValidateRestoreTaskRejectsDelimiterInjection(t *testing.T) {
+	task := RestoreTask{RepositoryID: "repo", SnapshotID: "abc123\x00/", Target: "/mnt/user/restore", Includes: []string{"/mnt/user/data"}}
+	if err := ValidateRestoreTask(task); err == nil {
+		t.Fatal("NUL-delimited snapshot injection accepted")
+	}
+	task.SnapshotID = "abc123"
+	task.InPlace = true
+	task.Includes = nil
+	if err := ValidateRestoreTask(task); err == nil {
+		t.Fatal("in-place restore without an include accepted")
+	}
+}
+
+func TestValidateConfigRejectsDuplicateManagedMountPoint(t *testing.T) {
+	c := DefaultConfig()
+	c.Repositories = []Repository{
+		{SchemaVersion: 1, ID: "one", Name: "One", Type: RepositorySMB, Location: "/mnt/remotes/shared", PasswordRef: "one-password", Mount: &MountConfig{Managed: true, Remote: "//one/share", MountPoint: "/mnt/remotes/shared"}},
+		{SchemaVersion: 1, ID: "two", Name: "Two", Type: RepositoryNFS, Location: "/mnt/remotes/shared", PasswordRef: "two-password", Mount: &MountConfig{Managed: true, Remote: "two:/share", MountPoint: "/mnt/remotes/shared"}},
+	}
+	if err := ValidateConfig(c); err == nil {
+		t.Fatal("duplicate managed mount point accepted")
+	}
+}
+
+func TestValidateConfigRejectsUnsafeRestoreRoot(t *testing.T) {
+	c := DefaultConfig()
+	c.Settings.RestoreRoot = "/etc/urbm-restores"
+	if err := ValidateConfig(c); err == nil {
+		t.Fatal("restoreRoot outside Unraid storage roots accepted")
+	}
+	c.Settings.RestoreRoot = "/mnt/user/urbm-restores"
+	if err := ValidateConfig(c); err != nil {
+		t.Fatalf("safe restoreRoot rejected: %v", err)
+	}
+}