Merge branch 'release/1.1.1'

.github/workflows/build-release.yml

@@ -18,14 +18,9 @@ jobs:
           - goarch: arm64
             goos: windows
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
 
-    - name: Set APP_VERSION env
-      run: echo APP_VERSION=$(echo ${GITHUB_REF} | rev | cut -d'/' -f 1 | rev ) >> ${GITHUB_ENV}
-    - name: Environment Printer
-      uses: managedkaos/[email protected]
-
-    - uses: wangyoucao577/[email protected]
+    - uses: wangyoucao577/[email protected]
       with:
         binary_name: "ssbak"
         asset_name: "ssbak_${{ matrix.goos }}_${{ matrix.goarch }}"
@@ -36,4 +31,4 @@ jobs:
         goos: ${{ matrix.goos }}
         goarch: ${{ matrix.goarch }}
         pre_command: export GO386=softfloat CGO_ENABLED=0
-        ldflags: -s -w -X "github.com/axllent/ssbak/cmd.Version=${{ env.APP_VERSION }}"
+        ldflags: -s -w -X "github.com/axllent/ssbak/cmd.Version=${{ github.ref_name }}"

CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## [1.1.1]
+
+- Fix self-updater (sorry!). If you are running 1.1.0 the self-updater will not work, so you will have to update manually unfortunately.
+- Update Go braries + security updates
+
+
 ## [1.1.0]
 
 - Native support for importing and exporting databases, eliminating MySQL client/server version incompatibility issues

README.md

@@ -33,6 +33,7 @@ SSBak is a self-contained static binary written in Go, and does not use third pa
 - Checks temporary and output locations have sufficient storage space **before** doing operations (Linux / Mac only).
 - Optional verbose output to see what it is doing.
 - Shell completion (see `ssbak completion -h`).
+- Built in version check & self-updater
 
 
 ## Usage
@@ -62,7 +63,7 @@ Use "ssbak [command] --help" for more information about a command.
 
 ## Installation & requirements
 
-- Download a suitable binary for your architecture (see [releases](https://github.com/axllent/ssbak/releases/latest)), extract the make it executable and place it in your $PATH. You can optionally save this as SSPak to use as a drop-in replacement for SSPak (see [limitations](#limitations)).
+- Download a suitable binary for your architecture (see [releases](https://github.com/axllent/ssbak/releases/latest)), extract the make it executable and place it in your $PATH. You can optionally rename "ssbak" to "sspak" to use as a drop-in replacement for SSPak (see [limitations](#limitations)).
 
 To compile SSBak from source: `go install github.com/axllent/ssbak@latest` (Go >= 1.14 required).
 

go.mod

@@ -7,6 +7,6 @@ require (
 	github.com/axllent/semver v0.0.1
 	github.com/go-sql-driver/mysql v1.7.0
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
-	github.com/joho/godotenv v1.4.0
+	github.com/joho/godotenv v1.5.1
 	github.com/spf13/cobra v1.6.1
 )

go.sum

@@ -13,8 +13,8 @@ github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/inconshreveable/mousetrap v1.0.1/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
-github.com/joho/godotenv v1.4.0 h1:3l4+N6zfMWnkbPEXKng2o2/MR5mSwTrBih4ZEkkz1lg=
-github.com/joho/godotenv v1.4.0/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
+github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
+github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
 github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=

utils/mysql.go

@@ -6,6 +6,7 @@ import (
 	"database/sql"
 	"fmt"
 	"os"
+	"path"
 	"path/filepath"
 	"strings"
 
@@ -35,7 +36,7 @@ func mysqlConfig() *mysql.Config {
 func MySQLDumpToGz(gzipFile string) error {
 	config := mysqlConfig()
 
-	f, err := os.Create(gzipFile)
+	f, err := os.Create(path.Clean(gzipFile))
 	if err != nil {
 		return fmt.Errorf("Error creating database backup: %s", err.Error())
 	}
@@ -94,14 +95,14 @@ func MySQLCreateDB(dropDatabase bool) error {
 	createMsg := `Creating database (if not exists)`
 
 	if dropDatabase {
-		app.Log(fmt.Sprintf("Dropping database `%s`", app.DB.Name))
+		app.Log(fmt.Sprintf("Dropping database '%s'", app.DB.Name))
 		if _, err := db.Exec("DROP DATABASE IF EXISTS `" + app.DB.Name + "`"); err != nil {
 			return err
 		}
 		createMsg = `Creating database`
 	}
 
-	app.Log(fmt.Sprintf("%s `%s`", createMsg, app.DB.Name))
+	app.Log(fmt.Sprintf("%s '%s'", createMsg, app.DB.Name))
 	_, err = db.Exec("CREATE DATABASE IF NOT EXISTS `" + app.DB.Name + "`")
 
 	return err
@@ -146,7 +147,7 @@ func MySQLLoadFromGz(gzipSQLFile string) error {
 	cbuffer := make([]byte, 0, bufio.MaxScanTokenSize)
 	fileScanner.Buffer(cbuffer, bufio.MaxScanTokenSize*50) // Otherwise long lines crash the scanner
 
-	app.Log(fmt.Sprintf("Importing database `%s`", app.DB.Name))
+	app.Log(fmt.Sprintf("Importing database to '%s'", app.DB.Name))
 
 	sql := ""
 
@@ -169,14 +170,15 @@ func MySQLLoadFromGz(gzipSQLFile string) error {
 			sql = sql + "\n" + line
 		}
 	}
+
 	// if any sql remains, execute
 	if strings.TrimSpace(sql) != "" {
 		if _, err := db.Exec(sql); err != nil {
 			return err
 		}
 	}
 
-	app.Log(fmt.Sprintf("Imported '%s' to `%s`", gzipSQLFile, app.DB.Name))
+	app.Log(fmt.Sprintf("Imported '%s' to '%s'", gzipSQLFile, app.DB.Name))
 
 	return err
 }

utils/sspak.go

@@ -122,7 +122,7 @@ func CreateSSPak(sspakFile string, files []string) error {
 		return err
 	}
 
-	file, err := os.Create(sspakFile)
+	file, err := os.Create(path.Clean(sspakFile))
 	if err != nil {
 		return fmt.Errorf("Could not create '%s': %s", sspakFile, err.Error())
 	}

utils/targz.go

@@ -11,6 +11,7 @@ import (
 	"os"
 	"path"
 	"path/filepath"
+	"strings"
 	"syscall"
 
 	"github.com/axllent/ssbak/app"
@@ -143,7 +144,7 @@ func compress(inPath, outFilePath, subPath string) (err error) {
 		return errors.New("targz: input directory is empty")
 	}
 
-	file, err := os.Create(outFilePath)
+	file, err := os.Create(path.Clean(outFilePath))
 	if err != nil {
 		return err
 	}
@@ -333,8 +334,13 @@ func extract(filePath string, directory string) error {
 		}
 
 		fileInfo := header.FileInfo()
+
+		if strings.HasPrefix(fileInfo.Name(), "..") {
+			continue
+		}
+
 		dir := filepath.Join(directory, filepath.Dir(header.Name))
-		filename := filepath.Join(dir, fileInfo.Name())
+		filename := filepath.Join(dir, path.Clean(fileInfo.Name()))
 
 		if skipResampled(filename) {
 			continue
@@ -363,12 +369,12 @@ func extract(filePath string, directory string) error {
 			}
 		}
 
-		file, err := os.Create(filename)
+		file, err := os.Create(filename) // #nosec
 		if err != nil {
 			return err
 		}
 
-		writer := bufio.NewWriter(file)
+		writer := bufio.NewWriter(file) // #nosec
 
 		buffer := make([]byte, 4096)
 		for {

utils/updater.go

@@ -7,6 +7,7 @@ import (
 	"io/ioutil"
 	"net/http"
 	"os"
+	"path"
 	"path/filepath"
 	"runtime"
 
@@ -188,7 +189,7 @@ func DownloadToFile(url, filepath string) error {
 	defer resp.Body.Close()
 
 	// Create the file
-	out, err := os.Create(filepath)
+	out, err := os.Create(path.Clean(filepath))
 	if err != nil {
 		return err
 	}

utils/utils.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"io"
 	"os"
+	"path"
 	"path/filepath"
 
 	"github.com/axllent/ssbak/app"
@@ -89,7 +90,7 @@ func GzipFile(file, output string) error {
 		}
 	}()
 
-	outFile, err := os.Create(output)
+	outFile, err := os.Create(path.Clean(output))
 	if err != nil {
 		return err
 	}