Skip to content

Prevent backup excludes from dropping directories - #889

Open
scuffi wants to merge 1 commit into
mainfrom
fix/859-backup-excludes-main
Open

Prevent backup excludes from dropping directories#889
scuffi wants to merge 1 commit into
mainfrom
fix/859-backup-excludes-main

Conversation

@scuffi

@scuffi scuffi commented Aug 28, 2026

Copy link
Copy Markdown
Contributor

Summary

Multi-component backup excludes were expanded as recursive matches, which could remove unrelated top-level directories from an archive.

Keep nested patterns root-relative and reject unsafe match-all or ambiguous globstar patterns.

Resolves #859 on main.

@changeset-bot

changeset-bot Bot commented Aug 28, 2026

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 50fa88b

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package
Name Type
@cloudflare/sandbox Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@devin-ai-integration devin-ai-integration Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔍 Devin Review: 1 flag

Not posted on this PR by your GitHub settings — view it in Devin Review. (Configure)

Devin Review

@pkg-pr-new

pkg-pr-new Bot commented Aug 28, 2026

Copy link
Copy Markdown

Open in StackBlitz

npm i https://pkg.pr.new/@cloudflare/sandbox@889

commit: 50fa88b

@github-actions

github-actions Bot commented Aug 28, 2026

Copy link
Copy Markdown
Contributor

🐳 Docker Images Published

Variant Image
Default cloudflare/sandbox:0.0.0-pr-889-50fa88bc
Python cloudflare/sandbox:0.0.0-pr-889-50fa88bc-python
OpenCode cloudflare/sandbox:0.0.0-pr-889-50fa88bc-opencode
Musl cloudflare/sandbox:0.0.0-pr-889-50fa88bc-musl

Usage:

FROM cloudflare/sandbox:0.0.0-pr-889-50fa88bc

Version: 0.0.0-pr-889-50fa88bc


📦 Standalone Binary

For arbitrary Dockerfiles:

COPY --from=cloudflare/sandbox:0.0.0-pr-889-50fa88bc /container-server/sandbox /sandbox
ENTRYPOINT ["/sandbox"]

Download via GitHub CLI:

gh run download 33652646659 -n sandbox-binary

Extract from Docker:

docker run --rm cloudflare/sandbox:0.0.0-pr-889-50fa88bc cat /container-server/sandbox > sandbox && chmod +x sandbox

@scuffi
scuffi force-pushed the fix/859-backup-excludes-main branch 2 times, most recently from 8ffd50b to f1911a9 Compare September 2, 2026 14:38
@scuffi
scuffi force-pushed the fix/859-backup-excludes-main branch from f1911a9 to 50fa88b Compare September 2, 2026 16:04
@scuffi

scuffi commented Sep 2, 2026

Copy link
Copy Markdown
Contributor Author

Ported the equivalent match-all hardening from #893 in 50fa88b. Patterns such as ***, *?, and ?* (including normalized globstar forms) now fail closed, with shared, SDK, container, and E2E regression coverage. The 405-pattern SDK/container parity probe still reports zero mismatches.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Backup silently drops entire top-level directories: ... a/b exclude expansion over-excludes on mksquashfs 4.5 (ubuntu:22.04 base)

1 participant