Nick Craig-Wood f5795d00c2 serve docker: re-derive volume mountpoint from name when restoring state GHSA-p6vx-hf7p-98j6 ...

When the plugin restarts it reads its persisted state file and used the
stored mountpoint verbatim. A state file written by an older rclone that
allowed escaping volume names, or one that was tampered with, could point
the mountpoint outside the base directory, so upgrading did not remediate
an already-escaped volume.

Re-derive the mountpoint from the base directory and the volume name on
restore, confined to the base directory, rather than trusting the stored
path.

2026-09-04 19:00:22 +01:00

..

api.go

build: modernize Go usage

2025-02-28 11:31:14 +00:00

docker_test.go

serve docker: re-derive volume mountpoint from name when restoring state GHSA-p6vx-hf7p-98j6

2026-09-04 19:00:22 +01:00

docker.go

docker serve: fix plugin timeout on restart when volumes have active mounts

2026-07-13 15:30:03 +01:00

docker.md

docker serve: add docs on what to expect when the plugin is restarted

2026-07-13 15:30:03 +01:00

driver.go

docker serve: make Create idempotent to avoid "volume already exists" after restart

2026-07-13 15:30:03 +01:00

options_test.go

build: modernize Go usage

2025-02-28 11:31:14 +00:00

options.go

docker serve: parse all remaining mount and VFS options

2025-01-11 18:39:15 +00:00

serve.go

Replace deprecated ioutil

2022-11-07 11:41:47 +00:00

systemd_unsupported.go

build: remove build constraint syntax for go 1.16 and older

2024-04-18 16:53:55 +02:00

systemd.go

build: remove build constraint syntax for go 1.16 and older

2024-04-18 16:53:55 +02:00

unix_unsupported.go

build: remove build constraint syntax for go 1.16 and older

2024-04-18 16:53:55 +02:00

unix.go

build: remove build constraint syntax for go 1.16 and older

2024-04-18 16:53:55 +02:00

volume.go

serve docker: re-derive volume mountpoint from name when restoring state GHSA-p6vx-hf7p-98j6

2026-09-04 19:00:22 +01:00