replace starting dot and slashes in db names

since the name of the database is used in the file name, it could be
used to forge bad path. So prepend the db name with a _ if it starts
with a dot to avoid hidden files and replace any slash (os separator) by
an underscore to avoid creating directories

main.go

@@ -672,9 +672,27 @@ func relPath(basedir, path string) string {
 	return target
 }
 
+func cleanDBName(dbname string) string {
+	// We do not want a database name starting with a dot to avoid creating hidden files
+	if strings.HasPrefix(dbname, ".") {
+		dbname = "_" + dbname
+	}
+
+	// If there is a path separator in the database name, we do not want to
+	// create the dump in a subdirectory or in a parent directory
+	if strings.ContainsRune(dbname, os.PathSeparator) {
+		dbname = strings.ReplaceAll(dbname, string(os.PathSeparator), "_")
+	}
+
+	return dbname
+}
+
 func formatDumpPath(dir string, timeFormat string, suffix string, dbname string, when time.Time) string {
 	var f, s, d string
 
+	// Avoid attacks on the database name
+	dbname = cleanDBName(dbname)
+
 	d = dir
 	if dbname != "" {
 		d = strings.Replace(dir, "{dbname}", dbname, -1)

purge.go

@@ -58,7 +58,7 @@ func purgeDumps(directory string, dbname string, keep int, limit time.Time) erro
 			return fmt.Errorf("could not purge %s: %s", dirpath, err)
 		}
 
-		if strings.HasPrefix(f[0].Name(), dbname+"_") &&
+		if strings.HasPrefix(f[0].Name(), cleanDBName(dbname)+"_") &&
 			(!f[0].IsDir() || strings.HasSuffix(f[0].Name(), ".d")) {
 			dirContents = append(dirContents, f[0])
 		}
@@ -101,7 +101,7 @@ func purgeRemoteDumps(repo Repo, directory string, dbname string, keep int, limi
 	// remote path along with any subdirectory. So we have to include it in
 	// the filter when listing remote files
 	dirpath := filepath.Dir(formatDumpPath(directory, "", "", dbname, time.Time{}))
-	prefix := relPath(directory, filepath.Join(dirpath, dbname))
+	prefix := relPath(directory, filepath.Join(dirpath, cleanDBName(dbname)))
 
 	files, err := repo.List(prefix)
 	if err != nil {