Bug

restore() in _snapshot.py parses user-controlled ref strings and interpolates the path segment directly into shell commands without quoting or validation:

parts = ref.split(":", 2)
snap_path = parts[2]  # attacker-controlled
await env.exec(f"test -f {snap_path} && echo ok || echo missing")
await env.exec(f"tar xzf {snap_path} -C {workspace}")

A crafted ref like fs:x:/tmp/ok; rm -rf / injects arbitrary shell commands.

Since restore() and snapshot() are exported as public API from __init__.py, any caller passing an untrusted ref is vulnerable.

Fix

• Validate snap_path must be under _SNAP_DIR and end with .tar.gz
• Reject .. path traversal components
• Quote all shell arguments with shlex.quote()
• Harden snapshot() with shlex.quote for consistency

Test

# Crafted ref is blocked by .tar.gz suffix check
ref = "fs:x:/tmp/.benchflow_snapshots/x; rm -rf /"
# -> ValueError: path must be under _SNAP_DIR

# Path traversal is blocked
ref = "fs:x:/tmp/.benchflow_snapshots/../../etc/passwd.tar.gz"  
# -> ValueError: path traversal not allowed