[PATCH proxmox-backup v3] fix #7382: correctly anchor nested paths for include/exclude patterns.

[PATCH proxmox-backup v3] fix #7382: correctly anchor nested paths for include/exclude patterns.

[Manuel Federanko]

A pattern in a subdirectory would be built by just prepending the parent
directory. This could break anchored patterns, which wouldn't match if
the parent directory didn't start with a slash.
Fixed this by explicitly checking if the base path starts with a slash
and prepending it if it does not exist.

It worked for anchored patterns in the root backup directory because
here the pattern is "" + "/exclude".

old:
match_path = /level0/level1/exclude
pattern = level0/level1/exclude

new:
match_path = /level0/level1/exclude
pattern = /level0/level1/exclude

Tested by creating a directory structure as described in the bug ticket
and verifying the behavior.

Signed-off-by: Manuel Federanko <m.federanko@proxmox.com>
Fixes: https://bugzilla.proxmox.com/show_bug.cgi?id=7382
---
changed since v2:
* fix clippy warnings (sorry for the churn)
changed since v1:
* use path_bytes.starts_with (thanks Maximiliano for feedback off-list)

 pbs-client/src/pxar/create.rs | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/pbs-client/src/pxar/create.rs b/pbs-client/src/pxar/create.rs
index 7f605a61..e42bcc87 100644
--- a/pbs-client/src/pxar/create.rs
+++ b/pbs-client/src/pxar/create.rs
@@ -537,13 +537,20 @@ impl Archiver {

             let mut buf;
             let (line, mode, anchored) = if line[0] == b'/' {
-                buf = Vec::with_capacity(path_bytes.len() + 1 + line.len());
+                buf = Vec::with_capacity(path_bytes.len() + 2 + line.len());
+                // need to anchor the base path if it is not
+                if !path_bytes.is_empty() && !path_bytes.starts_with(b"/") {
+                    buf.push(b'/');
+                }
                 buf.extend(path_bytes);
                 buf.extend(line);
                 (&buf[..], MatchType::Exclude, true)
             } else if line.starts_with(b"!/") {
                 // inverted case with absolute path
-                buf = Vec::with_capacity(path_bytes.len() + line.len());
+                buf = Vec::with_capacity(path_bytes.len() + 1 + line.len());
+                if !path_bytes.is_empty() && !path_bytes.starts_with(b"/") {
+                    buf.push(b'/');
+                }
                 buf.extend(path_bytes);
                 buf.extend(&line[1..]); // without the '!'
                 (&buf[..], MatchType::Include, true)
--
2.47.3

Re: [PATCH proxmox-backup v3] fix #7382: correctly anchor nested paths for include/exclude patterns.

[Christian Ebner]

On 3/16/26 3:23 PM, Manuel Federanko wrote:
> A pattern in a subdirectory would be built by just prepending the parent
> directory. This could break anchored patterns, which wouldn't match if
> the parent directory didn't start with a slash.
> Fixed this by explicitly checking if the base path starts with a slash
> and prepending it if it does not exist.
> 
> It worked for anchored patterns in the root backup directory because
> here the pattern is "" + "/exclude".
> 
> old:
> match_path = /level0/level1/exclude
> pattern = level0/level1/exclude
> 
> new:
> match_path = /level0/level1/exclude
> pattern = /level0/level1/exclude
> 
> Tested by creating a directory structure as described in the bug ticket
> and verifying the behavior.
> 
> Signed-off-by: Manuel Federanko <m.federanko@proxmox.com>
> Fixes: https://bugzilla.proxmox.com/show_bug.cgi?id=7382
> ---

Thanks a lot for the patch, looks good to me!

Although one question came up during review:

Will the `Archiver` path ever start with a '/' at all?

As far as I could see it is set to be empty on instantiation (which is 
equal to the pxar source root), and only filenames from dir entries are 
pushed or popped from the path. So it seems the additional check for
`!path_bytes.starts_with(b"/")` is not strictly required? Or am I 
missing it?

But leaving this in place as additional check for robustness is probably 
fine.

Re: [PATCH proxmox-backup v3] fix #7382: correctly anchor nested paths for include/exclude patterns.

[Manuel Federanko]

On 2026-03-17 4:02 PM, Christian Ebner wrote:
> On 3/16/26 3:23 PM, Manuel Federanko wrote:
>> A pattern in a subdirectory would be built by just prepending the parent
>> directory. This could break anchored patterns, which wouldn't match if
>> the parent directory didn't start with a slash.
>> Fixed this by explicitly checking if the base path starts with a slash
>> and prepending it if it does not exist.
>> 
>> It worked for anchored patterns in the root backup directory because
>> here the pattern is "" + "/exclude".
>> 
>> old:
>> match_path = /level0/level1/exclude
>> pattern = level0/level1/exclude
>> 
>> new:
>> match_path = /level0/level1/exclude
>> pattern = /level0/level1/exclude
>> 
>> Tested by creating a directory structure as described in the bug ticket
>> and verifying the behavior.
>> 
>> Signed-off-by: Manuel Federanko <m.federanko@proxmox.com>
>> Fixes: https://bugzilla.proxmox.com/show_bug.cgi?id=7382
>> ---
> 
> Thanks a lot for the patch, looks good to me!
> 
> Although one question came up during review:
> 
> Will the `Archiver` path ever start with a '/' at all?
> 
> As far as I could see it is set to be empty on instantiation (which is 
> equal to the pxar source root), and only filenames from dir entries are 
> pushed or popped from the path. So it seems the additional check for
> `!path_bytes.starts_with(b"/")` is not strictly required? Or am I 
> missing it?
> 
> But leaving this in place as additional check for robustness is probably 
> fine.
I was considering this, but didn't want to leave it up to chance
considering further developments. Seeing as the the !path_bytes.is_empty()
is required anyways I left it in.

Re: [PATCH proxmox-backup v3] fix #7382: correctly anchor nested paths for include/exclude patterns.

[Christian Ebner]

On 3/17/26 4:08 PM, Manuel Federanko wrote:
> On 2026-03-17 4:02 PM, Christian Ebner wrote:
>> On 3/16/26 3:23 PM, Manuel Federanko wrote:
>>> A pattern in a subdirectory would be built by just prepending the parent
>>> directory. This could break anchored patterns, which wouldn't match if
>>> the parent directory didn't start with a slash.
>>> Fixed this by explicitly checking if the base path starts with a slash
>>> and prepending it if it does not exist.
>>>
>>> It worked for anchored patterns in the root backup directory because
>>> here the pattern is "" + "/exclude".
>>>
>>> old:
>>> match_path = /level0/level1/exclude
>>> pattern = level0/level1/exclude
>>>
>>> new:
>>> match_path = /level0/level1/exclude
>>> pattern = /level0/level1/exclude
>>>
>>> Tested by creating a directory structure as described in the bug ticket
>>> and verifying the behavior.
>>>
>>> Signed-off-by: Manuel Federanko <m.federanko@proxmox.com>
>>> Fixes: https://bugzilla.proxmox.com/show_bug.cgi?id=7382
>>> ---
>>
>> Thanks a lot for the patch, looks good to me!
>>
>> Although one question came up during review:
>>
>> Will the `Archiver` path ever start with a '/' at all?
>>
>> As far as I could see it is set to be empty on instantiation (which is
>> equal to the pxar source root), and only filenames from dir entries are
>> pushed or popped from the path. So it seems the additional check for
>> `!path_bytes.starts_with(b"/")` is not strictly required? Or am I
>> missing it?
>>
>> But leaving this in place as additional check for robustness is probably
>> fine.
> I was considering this, but didn't want to leave it up to chance
> considering further developments. Seeing as the the !path_bytes.is_empty()
> is required anyways I left it in.


Okay, thanks for clarification.

Reviewed-by: Christian Ebner <c.ebner@proxmox.com>