From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) by lore.proxmox.com (Postfix) with ESMTPS id 3F37A1FF141 for ; Mon, 16 Mar 2026 14:48:59 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 883E21B93C; Mon, 16 Mar 2026 14:49:10 +0100 (CET) From: Manuel Federanko To: pbs-devel@lists.proxmox.com Subject: [PATCH proxmox-backup v2] fix #7382: correctly anchor nested paths for include/exclude patterns. Date: Mon, 16 Mar 2026 14:49:06 +0100 Message-ID: <20260316134906.53471-1-m.federanko@proxmox.com> X-Mailer: git-send-email 2.47.3 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 1 AWL -1.402 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy HEADER_FROM_DIFFERENT_DOMAINS 0.25 From and EnvelopeFrom 2nd level mail domains are different KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment KAM_LAZY_DOMAIN_SECURITY 1 Sending domain does not have any anti-forgery methods POISEN_SPAM_PILL 0.1 Meta: its spam POISEN_SPAM_PILL_1 0.1 random spam to be learned in bayes POISEN_SPAM_PILL_3 0.1 random spam to be learned in bayes RCVD_IN_VALIDITY_CERTIFIED_BLOCKED 0.408 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. RCVD_IN_VALIDITY_RPBL_BLOCKED 0.819 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. RCVD_IN_VALIDITY_SAFE_BLOCKED 0.903 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. RDNS_NONE 0.793 Delivered to internal network by a host with no rDNS SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_NONE 0.001 SPF: sender does not publish an SPF Record Message-ID-Hash: RQDJUCUZWGWAODDFILCQ7KQBQ76TR2GI X-Message-ID-Hash: RQDJUCUZWGWAODDFILCQ7KQBQ76TR2GI X-MailFrom: mfederanko@dev.localdomain X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox Backup Server development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: A pattern in a subdirectory would be built by just prepending the parent directory. This could break anchored patterns, which wouldn't match if the parent directory didn't start with a slash. Fixed this by explicitly checking if the base path starts with a slash and prepending it if it does not exist. It worked for anchored patterns in the root backup directory because here the pattern is "" + "/exclude". old: match_path = /level0/level1/exclude pattern = level0/level1/exclude new: match_path = /level0/level1/exclude pattern = /level0/level1/exclude Tested by creating a directory structure as described in the bug ticket and verifying the behavior. Signed-off-by: Manuel Federanko Fixes: https://bugzilla.proxmox.com/show_bug.cgi?id=7382 --- changed since v1: * use path_bytes.starts_with. pbs-client/src/pxar/create.rs | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/pbs-client/src/pxar/create.rs b/pbs-client/src/pxar/create.rs index 7f605a61..5400288c 100644 --- a/pbs-client/src/pxar/create.rs +++ b/pbs-client/src/pxar/create.rs @@ -537,13 +537,20 @@ impl Archiver { let mut buf; let (line, mode, anchored) = if line[0] == b'/' { - buf = Vec::with_capacity(path_bytes.len() + 1 + line.len()); + buf = Vec::with_capacity(path_bytes.len() + 2 + line.len()); + // need to anchor the base path if it is not + if path_bytes.len() > 0 && !path_bytes.starts_with(b"/") { + buf.push(b'/'); + } buf.extend(path_bytes); buf.extend(line); (&buf[..], MatchType::Exclude, true) } else if line.starts_with(b"!/") { // inverted case with absolute path - buf = Vec::with_capacity(path_bytes.len() + line.len()); + buf = Vec::with_capacity(path_bytes.len() + 1 + line.len()); + if path_bytes.len() > 0 && !path_bytes.starts_with(b"/") { + buf.push(b'/'); + } buf.extend(path_bytes); buf.extend(&line[1..]); // without the '!' (&buf[..], MatchType::Include, true) -- 2.47.3