SECURITY: Prevent shell injection attacks via constant interpolation in command hooks.

NEWS

@@ -20,6 +20,8 @@
  * When syslog verbosity is enabled, log to systemd's journal (if present) with
    structured data. See the documentation for more information:
    https://torsion.org/borgmatic/reference/command-line/logging/#systemd-journal
+ * SECURITY: Prevent shell injection attacks via constant interpolation in command hooks. (This was
+   already implemented for deprecated "before_*"/"after_*" command hooks.)
  * Promote the ZFS, LVM, and Btrfs hooks from beta features to stable.
 
 2.0.13

borgmatic/config/constants.py

@@ -58,7 +58,7 @@ def apply_constants(value, constants, shell_escape=False):
                 shell_escape=(
                     shell_escape
                     or option_name.startswith(('before_', 'after_'))
-                    or option_name == 'on_error'
+                    or option_name in {'on_error', 'run'}
                 ),
             )
 

tests/unit/config/test_constants.py

@@ -50,6 +50,7 @@ def test_apply_constants_with_empty_constants_passes_through_value():
         ({'before_backup': '{inject}'}, {'before_backup': "'echo hi; naughty-command'"}),
         ({'after_backup': '{inject}'}, {'after_backup': "'echo hi; naughty-command'"}),
         ({'on_error': '{inject}'}, {'on_error': "'echo hi; naughty-command'"}),
+        ({'run': '{inject}'}, {'run': "'echo hi; naughty-command'"}),
         (
             {
                 'before_backup': '{env_pass}',