backupdrill 2.2.3 → 2.2.4

package/dist/backup.js

@@ -17,7 +17,7 @@ import { dumpPartSizeFor } from "./part-size.js";
 // 解析函数搬到了 pgbin(演练与恢复都要读 pg_restore 版本,放这里会成环);保留旧出口
 export { parsePgDumpMajor };
 import { dumpUrlFor, connectPg, isSupabaseHost } from "./supabase-ca.js";
-import { libpqChildEnv, urlSslModeOf } from "./restore-engine.js";
+import { credentialSafeDbArgs, libpqChildEnv, urlSslModeOf } from "./restore-engine.js";
 const execFileAsync = promisify(execFile);
 function majorOf(serverVersionNum) {
     // server_version_num: 150004 → 15,  170002 → 17
@@ -106,7 +106,9 @@ async function dumpToS3(config, s3, key, pgDumpBin, partSize) {
     });
     const schemaArgs = config.schemas.map((s) => `--schema=${s}`);
     // pg_dump(libpq):Supabase 主机才改写成 sslmode=verify-full + sslrootcert=<打包CA临时文件>
-    const dumpDbUrl = dumpUrlFor(config.databaseUrl);
+    // 凭据不进 argv(D6):argv 对同机任何进程的 `ps` 可见。与恢复路径同一个函数——
+    // 先改写 SSL 再拆密码,密码经 PGPASSWORD 交给 libpq
+    const { url: dumpDbUrl, env: credentialEnv } = credentialSafeDbArgs(dumpUrlFor(config.databaseUrl));
     const dump = spawn(pgDumpBin, [
         "--format=custom",
         "--no-owner",
@@ -118,7 +120,7 @@ async function dumpToS3(config, s3, key, pgDumpBin, partSize) {
     // 环境剔除改写目标/身份的 PG* 变量:pg_dump 只认 --dbname 里的 URL(TLS 策略等保留)
     {
         stdio: ["ignore", "pipe", "pipe"],
-        env: libpqChildEnv({}, process.env, {
+        env: libpqChildEnv(credentialEnv, process.env, {
             supabaseHost: isSupabaseHost(config.databaseUrl),
             urlSslMode: urlSslModeOf(dumpDbUrl),
         }),

package/dist/restore-engine.js

@@ -395,6 +395,10 @@ export function credentialSafeDbArgs(connString) {
         }
         return { url: connString, env: {} };
     }
+    // 兜底(入口的 assertNoHostOverride 已拒字面 #):片段留在输出里,libpq 会把 `#?host=…` 当查询参数
+    if (url.hash) {
+        throw new Error("connection string contains a literal '#' — percent-encode it as %23 (for example inside the password).");
+    }
     let password = "";
     if (url.password) {
         try {
@@ -427,9 +431,9 @@ export function credentialSafeDbArgs(connString) {
             if (/^password$/i.test(key)) {
                 const rawValue = eq === -1 ? "" : part.slice(eq + 1);
                 try {
-                    const value = decodeURIComponent(rawValue.replace(/\+/g, "%20"));
-                    if (value)
-                        queryPasswords.push(value);
+                    // 空值也要记:libpq 取最后一个(空 = 回落 .pgpass),只记非空会把前面的旧值
+                    // 当成密码——?password=stale&password= 预检走 .pgpass、pg_dump 却用 stale
+                    queryPasswords.push(decodeURIComponent(rawValue.replace(/\+/g, "%20")));
                 }
                 catch {
                     throw new Error("the connection string ?password= value contains malformed percent-encoding — " +
@@ -469,6 +473,12 @@ export function assertNoHostOverride(connString) {
     if (containsNul(connString)) {
         throw new Error("connection string contains a NUL byte — use a plain connection string.");
     }
+    // 字面 # 同样在解析前拒:WHATWG URL 把 # 之后当片段,这里看到的主机干净;libpq 不认片段,
+    // 剥掉 ?password= 后剩下的 `#?host=…` 会被它读成查询参数,改写连接目标(交叉审查)。
+    // 合法的 # 只会出现在密码等值里,写成 %23 即可
+    if (connString.includes("#")) {
+        throw new Error("connection string contains a literal '#' — percent-encode it as %23 (for example inside the password).");
+    }
     // 解析不了的连接串直接拒:曾经"放行让 pg 自己报错",但 pg 的解析器比 WHATWG URL 宽
     // (`postgresql://user@/db?host=…` 这类串 pg 接受、这里解析失败),放行 = 身份判定为空却照样连接
     // (交叉审查)。校验逻辑放在 try 外面——曾按文案里有没有 "override" 决定重抛,新理由一措辞不同就被吞。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "backupdrill",
-  "version": "2.2.3",
+  "version": "2.2.4",
   "description": "Open-source CLI to back up a Supabase project — Postgres database and Storage files — to your own S3/R2/B2 bucket, with a checksummed manifest.",
   "type": "module",
   "bin": {