lxd: Add strict backup name requirements

Signed-off-by: Mark Bolton <[email protected]>

lxd/storage/backend_lxd.go

@@ -15,6 +15,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"regexp"
 	"slices"
 	"strings"
 	"sync"
@@ -7844,8 +7845,19 @@ func (b *lxdBackend) CreateBucketFromBackup(srcBackup backup.Info, srcData io.Re
 	revert := revert.New()
 	defer revert.Fail()
 
+	// Validate the name
+	srcBackupName := srcBackup.Name
+	match, err := regexp.MatchString(`^[a-z0-9][\-a-z0-9]{2,62}$`, srcBackupName)
+	if err != nil {
+		return err
+	}
+
+	if !match {
+		return fmt.Errorf("Backup name must be between 3 and 63 lowercase letters, numbers, or hyphens and must start with a letter or number")
+	}
+
 	bucketRequest := api.StorageBucketsPost{
-		Name:             srcBackup.Name,
+		Name:             srcBackupName,
 		StorageBucketPut: srcBackup.Config.Bucket.Writable(),
 	}
 

lxd/storage_buckets_backup.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"net/http"
 	"net/url"
+	"regexp"
 	"strings"
 	"time"
 
@@ -564,8 +565,14 @@ func storagePoolBucketBackupPost(d *Daemon, r *http.Request) response.Response {
 	}
 
 	// Validate the name
-	if strings.Contains(req.Name, "/") {
-		return response.BadRequest(fmt.Errorf("Backup names may not contain slashes"))
+	newBackupName := req.Name
+	match, err := regexp.MatchString(`^[a-z0-9][\-a-z0-9]{2,62}$`, newBackupName)
+	if err != nil {
+		return response.BadRequest(err)
+	}
+
+	if !match {
+		return response.BadRequest(fmt.Errorf("Backup name must be between 3 and 63 lowercase letters, numbers, or hyphens and must start with a letter or number"))
 	}
 
 	oldName := bucketName + shared.SnapshotDelimiter + backupName
@@ -575,7 +582,7 @@ func storagePoolBucketBackupPost(d *Daemon, r *http.Request) response.Response {
 		return response.SmartError(err)
 	}
 
-	newName := backup.BucketName() + shared.SnapshotDelimiter + req.Name
+	newName := backup.BucketName() + shared.SnapshotDelimiter + newBackupName
 
 	rename := func(op *operations.Operation) error {
 		err := backup.Rename(newName)