Page MenuHomeFreeBSD

scp: check in scp client that filenames sent during
ClosedPublic

Authored by emaste on Feb 4 2019, 4:45 PM.
Tags
None
Referenced Files
Unknown Object (File)
Jan 8 2024, 1:36 PM
Unknown Object (File)
Jan 2 2024, 4:08 PM
Unknown Object (File)
Dec 26 2023, 8:44 PM
Unknown Object (File)
Dec 25 2023, 3:05 AM
Unknown Object (File)
Dec 22 2023, 10:00 PM
Unknown Object (File)
Nov 30 2023, 7:55 AM
Unknown Object (File)
Nov 17 2023, 6:01 PM
Unknown Object (File)
Nov 4 2023, 1:34 AM
Subscribers

Details

Summary

remote->local directory copies satisfy the wildcard specified by the user.

This checking provides some protection against a malicious server
sending unexpected filenames, but it comes at a risk of rejecting wanted
files due to differences between client and server wildcard expansion rules.

For this reason, this also adds a new -T flag to disable the check.

reported by Harry Sintonen
fix approach suggested by markus@;
has been in snaps for ~1wk courtesy deraadt@

OpenBSD-Commit-ID: 00f44b50d2be8e321973f3c6d014260f8f7a8eda

Minor patch conflict (getopt) resolved.

Obtained from: OpenSSH-portable 391ffc4b9d31fa1f4ad566499fef9176ff8a07dc

scp: add -T to usage();

OpenBSD-Commit-ID: a7ae14d9436c64e1bd05022329187ea3a0ce1899

Obtained from: OpenSSH-portable 2c21b75a7be6ebdcbceaebb43157c48dbb36f3d8

Diff Detail

Lint
Lint Skipped
Unit
Tests Skipped

Event Timeline

Actually resolve getopt conflict

I believe that this is equivalent to merging rS343766 and rS343767, so please do an svn merge --record-only before committing.

This revision is now accepted and ready to land.Feb 5 2019, 1:03 PM
This revision was automatically updated to reflect the committed changes.