backup: M4-2b reject walker-skipped names + backslash in encoded keymap path (codex P2 #928 round 4)

Two related findings on encode_s3_collision.go's validateKeymapEncodedPath:

1. Encoded backslash slips past slash-only segment scan. On Windows
   filepath.Join treats '\' as a path separator, but
   strings.Split(encoded, '/') doesn't see it. A corrupt KEYMAP
   entry like 'dir\\x.elastickv-leaf-data' passes target
   verification (Lstat against the joined Windows path) and the
   walk later looks up the slash-form, missing the backslash-keyed
   record - emits the renamed on-disk key instead of failing closed.

2. Encoded targets that the walker skips. walkObjectEntry returns
   nil for top-level '_bucket.json', top-level 'KEYMAP.jsonl' (when
   a tracker is loaded), and anything ending in
   S3MetaSuffixReserved (sidecars). A KEYMAP entry naming one of
   those paths passes the IsRegular check but the walk drops it -
   the rename is silently ignored.

Fix: validateKeymapEncodedPath now also:
- Rejects any backslash anywhere in rec.Encoded (mirrors
  safeJoinUnderRoot's backslash guard).
- Rejects encoded paths ending in S3MetaSuffixReserved (sidecar
  suffix at any depth).
- Rejects bare '_bucket.json' and 'KEYMAP.jsonl' (top-level
  control files). Nested 'prefix/_bucket.json' and
  'prefix/KEYMAP.jsonl' remain valid user object keys (the walk
  processes them normally).

Caller audit: validateKeymapEncodedPath is invoked once from
validateKeymapRecord (single chain). No call-site changes.

Regression tests:
- TestValidateKeymapEncodedPath_Backslash: 4 cases covering
  middle / leading / trailing / multi-segment backslash.
- TestValidateKeymapEncodedPath_WalkerSkipped: 6-case table
  covering top-level reserved + sidecar suffix (top-level +
  nested) + accepted nested user-key forms.

Author: bootjp

internal/backup/encode_s3_collision.go

@@ -193,17 +193,46 @@ func validateKeymapOriginalPath(rec KeymapRecord, original string) error {
 }
 
 // validateKeymapEncodedPath rejects rec.Encoded values that would
-// escape the bucket sub-root or carry empty segments. The lookup
-// site (resolveObjectKeyFromRel) joins this value under bucketDir
-// when calling root.Lstat, and ".." would silently break out of the
-// bucket. Gemini medium PR #928.
+// escape the bucket sub-root, carry empty segments, contain
+// backslashes filepath.Join splits on Windows, or name a
+// walker-skipped control/sidecar file that encodeObject never
+// reaches.
+//
+// Path segments: gemini medium PR #928.
+// Backslash + walker-skipped reserved names: codex P2 #928 round 4.
+//   - The walker (walkObjectEntry) returns nil for top-level
+//     "_bucket.json" and top-level "KEYMAP.jsonl" (when a tracker
+//     is loaded) and for any file ending in S3MetaSuffixReserved.
+//     A KEYMAP entry whose Encoded names one of those passes the
+//     IsRegular check in verifyKeymapTargetsExist but is silently
+//     ignored by the walk - the corruption surfaces only as a
+//     missing-key during restore.
 func validateKeymapEncodedPath(encoded string) error {
-	for _, seg := range strings.Split(encoded, "/") {
+	if strings.ContainsRune(encoded, '\\') {
+		return errors.Wrapf(ErrInvalidKeymapRecord,
+			"encoded path %q contains backslash (treated as a separator on Windows; rename in S3 first)", encoded)
+	}
+	segs := strings.Split(encoded, "/")
+	for _, seg := range segs {
 		if seg == "" || seg == "." || seg == ".." {
 			return errors.Wrapf(ErrInvalidKeymapRecord,
 				"encoded path %q contains invalid segment %q", encoded, seg)
 		}
 	}
+	last := segs[len(segs)-1]
+	if strings.HasSuffix(last, S3MetaSuffixReserved) {
+		return errors.Wrapf(ErrInvalidKeymapRecord,
+			"encoded path %q ends in reserved sidecar suffix %q (walker would skip)",
+			encoded, S3MetaSuffixReserved)
+	}
+	// _bucket.json and KEYMAP.jsonl are walker-skipped only at the
+	// top level (rel == ""). Nested user keys like
+	// "prefix/_bucket.json" are real object bodies that the walk
+	// processes normally, so accept those.
+	if len(segs) == 1 && (segs[0] == "_bucket.json" || segs[0] == "KEYMAP.jsonl") {
+		return errors.Wrapf(ErrInvalidKeymapRecord,
+			"encoded path %q names a top-level control file the walker skips", encoded)
+	}
 	return nil
 }
 

internal/backup/encode_s3_collision_test.go

@@ -253,6 +253,76 @@ func TestValidateKeymapRecord_EmptyOriginal(t *testing.T) {
 	}
 }
 
+// TestValidateKeymapEncodedPath_Backslash pins codex P2 #928
+// round 4 (encoded-backslash): a corrupt KEYMAP Encoded value with
+// a backslash bypasses the slash-segment scan on Windows because
+// filepath.Join treats `\` as a separator. The validator must
+// reject backslashes anywhere in the encoded path.
+func TestValidateKeymapEncodedPath_Backslash(t *testing.T) {
+	t.Parallel()
+	cases := []string{
+		`dir\x` + S3LeafDataSuffix,
+		`a\b\c` + S3LeafDataSuffix,
+		`\leading` + S3LeafDataSuffix,
+		`trailing\` + S3LeafDataSuffix,
+	}
+	for _, enc := range cases {
+		t.Run(enc, func(t *testing.T) {
+			t.Parallel()
+			rec := leafRecord(enc, "ok/key")
+			err := validateKeymapRecord(rec)
+			if !errors.Is(err, ErrInvalidKeymapRecord) {
+				t.Fatalf("err = %v, want ErrInvalidKeymapRecord", err)
+			}
+			if !strings.Contains(err.Error(), "backslash") {
+				t.Fatalf("err = %v, want backslash message", err)
+			}
+		})
+	}
+}
+
+// TestValidateKeymapEncodedPath_WalkerSkipped pins codex P2 #928
+// round 4 (walker-skipped reserved files): a corrupt KEYMAP entry
+// whose Encoded names a top-level "_bucket.json" / "KEYMAP.jsonl"
+// or any path ending in S3MetaSuffixReserved passes the IsRegular
+// check but the walk silently skips it — the rename is never
+// reversed and the operator sees no diagnostic. The validator must
+// reject these encoded values at load time.
+func TestValidateKeymapEncodedPath_WalkerSkipped(t *testing.T) {
+	t.Parallel()
+	cases := []struct {
+		name    string
+		encoded string
+		wantErr bool
+	}{
+		{"top-level _bucket.json", "_bucket.json", true},
+		{"top-level KEYMAP.jsonl", "KEYMAP.jsonl", true},
+		{"sidecar suffix (top-level)", "obj" + S3MetaSuffixReserved, true},
+		{"sidecar suffix (nested)", "prefix/obj" + S3MetaSuffixReserved, true},
+		// Nested _bucket.json / KEYMAP.jsonl ARE real user objects
+		// the walker processes - accept them.
+		{"nested _bucket.json (user key)", "prefix/_bucket.json", false},
+		{"nested KEYMAP.jsonl (user key)", "prefix/KEYMAP.jsonl", false},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			t.Parallel()
+			rec := KeymapRecord{
+				Encoded:     c.encoded,
+				OriginalB64: base64.RawURLEncoding.EncodeToString([]byte("original/key")),
+				Kind:        KindSHAFallback,
+			}
+			err := validateKeymapRecord(rec)
+			if c.wantErr && !errors.Is(err, ErrInvalidKeymapRecord) {
+				t.Fatalf("err = %v, want ErrInvalidKeymapRecord", err)
+			}
+			if !c.wantErr && err != nil {
+				t.Fatalf("unexpected err = %v", err)
+			}
+		})
+	}
+}
+
 // TestValidateKeymapOriginalPath pins codex P2 #928 round 3: the
 // decoded original key must not contain any form the decoder's
 // safeJoinUnderRoot would refuse — NUL byte, backslash, dot