[PATCH proxmox-backup] fix #7382: correctly anchor nested paths for include/exclude patterns.

[PATCH proxmox-backup] fix #7382: correctly anchor nested paths for include/exclude patterns.

[Manuel Federanko]

A pattern in a subdirectory would be built by just prepending the parent
directory. This could break anchored patterns, which wouldn't match if
the parent directory didn't start with a slash.
Fixed this by explicitly checking if the base path starts with a slash
and prepending it if it does not exist.

It worked for anchored patterns in the root backup directory because
here the pattern is "" + "/exclude".

old:
match_path = /level0/level1/exclude
pattern = level0/level1/exclude

new:
match_path = /level0/level1/exclude
pattern = /level0/level1/exclude

Tested by creating a directory structure as described in the bug ticket
and verifying the behavior.

Signed-off-by: Manuel Federanko <m.federanko@proxmox.com>
---
 pbs-client/src/pxar/create.rs | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/pbs-client/src/pxar/create.rs b/pbs-client/src/pxar/create.rs
index 7f605a61..cec47749 100644
--- a/pbs-client/src/pxar/create.rs
+++ b/pbs-client/src/pxar/create.rs
@@ -537,13 +537,20 @@ impl Archiver {
 
             let mut buf;
             let (line, mode, anchored) = if line[0] == b'/' {
-                buf = Vec::with_capacity(path_bytes.len() + 1 + line.len());
+                buf = Vec::with_capacity(path_bytes.len() + 2 + line.len());
+                // need to anchor the base path if it is not
+                if path_bytes.len() > 0 && path_bytes[0] != b'/' {
+                    buf.push(b'/');
+                }
                 buf.extend(path_bytes);
                 buf.extend(line);
                 (&buf[..], MatchType::Exclude, true)
             } else if line.starts_with(b"!/") {
                 // inverted case with absolute path
-                buf = Vec::with_capacity(path_bytes.len() + line.len());
+                buf = Vec::with_capacity(path_bytes.len() + 1 + line.len());
+                if path_bytes.len() > 0 && path_bytes[0] != b'/' {
+                    buf.push(b'/');
+                }
                 buf.extend(path_bytes);
                 buf.extend(&line[1..]); // without the '!'
                 (&buf[..], MatchType::Include, true)
-- 
2.47.3

Re: [PATCH proxmox-backup] fix #7382: correctly anchor nested paths for include/exclude patterns.

[Nicolas Frey]

Hi, thanks for the patch! nit inline

On 3/16/26 1:04 PM, Manuel Federanko wrote:
> A pattern in a subdirectory would be built by just prepending the parent
> directory. This could break anchored patterns, which wouldn't match if
> the parent directory didn't start with a slash.
> Fixed this by explicitly checking if the base path starts with a slash
> and prepending it if it does not exist.
> 
> It worked for anchored patterns in the root backup directory because
> here the pattern is "" + "/exclude".
> 
> old:
> match_path = /level0/level1/exclude
> pattern = level0/level1/exclude
> 
> new:
> match_path = /level0/level1/exclude
> pattern = /level0/level1/exclude
> 
> Tested by creating a directory structure as described in the bug ticket
> and verifying the behavior.
> 

nit: consider adding a Fixes trailer to reference the bug report, like so:

Fixes: https://bugzilla.proxmox.com/show_bug.cgi?id=7382

> Signed-off-by: Manuel Federanko <m.federanko@proxmox.com>
> ---
>  pbs-client/src/pxar/create.rs | 11 +++++++++--
>  1 file changed, 9 insertions(+), 2 deletions(-)
> 
> diff --git a/pbs-client/src/pxar/create.rs b/pbs-client/src/pxar/create.rs
> index 7f605a61..cec47749 100644
> --- a/pbs-client/src/pxar/create.rs
> +++ b/pbs-client/src/pxar/create.rs
> @@ -537,13 +537,20 @@ impl Archiver {
>  
>              let mut buf;
>              let (line, mode, anchored) = if line[0] == b'/' {
> -                buf = Vec::with_capacity(path_bytes.len() + 1 + line.len());
> +                buf = Vec::with_capacity(path_bytes.len() + 2 + line.len());
> +                // need to anchor the base path if it is not
> +                if path_bytes.len() > 0 && path_bytes[0] != b'/' {
> +                    buf.push(b'/');
> +                }
>                  buf.extend(path_bytes);
>                  buf.extend(line);
>                  (&buf[..], MatchType::Exclude, true)
>              } else if line.starts_with(b"!/") {
>                  // inverted case with absolute path
> -                buf = Vec::with_capacity(path_bytes.len() + line.len());
> +                buf = Vec::with_capacity(path_bytes.len() + 1 + line.len());
> +                if path_bytes.len() > 0 && path_bytes[0] != b'/' {
> +                    buf.push(b'/');
> +                }
>                  buf.extend(path_bytes);
>                  buf.extend(&line[1..]); // without the '!'
>                  (&buf[..], MatchType::Include, true)

other than that, LGTM. Consider this:

Reviewed-by: Nicolas Frey <n.frey@proxmox.com>