UUXO/dbbackup
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 30 Wiki Activity
247 Commits 1 Branch 55 Tags
7e32a0369d4b183e61185957ae34ffa919131e99
Commit Graph

6 Commits

Author SHA1 Message Date
Alexander Renz
9d8a6e763e security: P0 fixes - SQL injection prevention + data race fix 
- Add identifier validation for database names in PostgreSQL and MySQL
  - validateIdentifier() rejects names with invalid characters
  - quoteIdentifier() safely quotes identifiers with proper escaping
  - Max length: 63 chars (PostgreSQL), 64 chars (MySQL)
  - Only allows alphanumeric + underscores, must start with letter/underscore

- Fix data race in notification manager
  - Multiple goroutines were appending to shared error slice
  - Added errMu sync.Mutex to protect concurrent error collection

- Security improvements prevent:
  - SQL injection via malicious database names
  - CREATE DATABASE `foo`; DROP DATABASE production; --`
  - Race conditions causing lost or corrupted error data
 2026-01-07 09:45:13 +01:00
A. Renz
914307ac8f ci: add golangci-lint config and fix formatting 
- Add .golangci.yml with minimal linters (govet, ineffassign)
- Run gofmt -s and goimports on all files to fix formatting
- Disable fieldalignment and copylocks checks in govet
 2025-12-11 17:53:28 +01:00
Renz
0cf21cd893 feat: Complete MEDIUM priority security features with testing 
- Implemented TUI auto-select for automated testing
- Fixed TUI automation: autoSelectMsg handling in Update()
- Auto-database selection in DatabaseSelector
- Created focused test suite (test_as_postgres.sh)
- Created retention policy test (test_retention.sh)
- All 10 security tests passing

Features validated:
✅ Backup retention policy (30 days, min backups)
✅ Rate limiting (exponential backoff)
✅ Privilege checks (root detection)
✅ Resource limit validation
✅ Path sanitization
✅ Checksum verification (SHA-256)
✅ Audit logging
✅ Secure permissions
✅ Configuration persistence
✅ TUI automation framework

Test results: 10/10 passed
Backup files created with .dump, .sha256, .info
Retention cleanup verified (old files removed)
 2025-11-25 15:25:56 +00:00
Renz
cfe5a663cd Fix MySQL connection handling: socket detection, timeouts, localhost vs remote 2025-10-25 10:33:29 +00:00
Renz
5e4dd0a2a4 Final debug pass 2025-10-24 19:03:06 +00:00
Renz
e361968022 Initial commit: Database Backup Tool v1.1.0 
- PostgreSQL and MySQL support
- Interactive TUI with fixed menu navigation
- Line-by-line progress display
- CPU-aware parallel processing
- Cross-platform build support
- Configuration settings menu
- Silent mode for TUI operations
 2025-10-22 19:27:38 +00:00