[Bug] Snapshot restore trusts destination directories from snapshot metadata

[xy200303]

Summary

System snapshot recovery reads directory values from the snapshot-contained base/snapshot.json and uses them as restore destinations without validating that they are panel-managed paths.

Affected revision

master at b47bba48273dcd56d0cfb1627632c1552ae97ba0.

Root cause

readFromJson unmarshals SnapshotJson directly from the downloaded and extracted snapshot. Subsequent recovery steps use BackupDataDir, OperestyDir, and BaseDir to create directories, extract archives, or construct restore paths. These values originate from snapshot content and are not constrained to an approved root.

Code locations

• agent/app/service/snapshot_recover.go:348-369 reads the snapshot metadata.
• agent/app/service/snapshot_recover.go:166 extracts the backup archive to snapJson.BackupDataDir.
• agent/app/service/snapshot_recover.go:181-206 uses snapJson.OperestyDir as a restore destination.
• agent/app/service/snapshot_recover.go:199 constructs a restore destination using snapJson.BaseDir.

Expected behavior

Snapshot metadata should not be allowed to redirect restore operations outside the configured 1Panel data, backup, and website directories. A snapshot recovery should either derive destinations exclusively from local configuration or validate embedded metadata against an explicit allowlist.

Actual behavior

The restore destination is influenced by values stored in the snapshot itself. The corresponding restore helpers then perform filesystem operations at those destinations.

Suggested fix

1. Treat embedded snapshot directory metadata as untrusted input.
2. Prefer locally configured restore roots rather than snapshot-provided absolute paths.
3. If compatibility requires embedded paths, canonicalize and validate each path against a strict allowlist of configured roots before any MkdirAll, archive extraction, copy, or restart operation.
4. Reject relative paths, empty values where a path is mandatory, and values outside the allowlisted roots.
5. Add regression tests covering snapshot metadata that requests an unexpected restore directory.

Notes

This is a public robustness report and intentionally excludes reproduction archives, binary replacement details, and deployment-specific impact chains. Please use the repository security contact for additional reproduction information.