nhyatt/putty-source
1
0
Fork 0
mirror of https://git.tartarus.org/simon/putty.git synced 2025-01-25 01:02:24 +00:00
Code Issues Projects Releases Wiki Activity

pscp: extra security check in SCP mode.

Browse Source 
When you don't specify -r, we now check whether the server is sending
a whole subdirectory in place of a single file, and abort if it does.
Previously we'd accept the subdirectory download regardless.

The new error message labels this as a security violation, just on the
grounds that it involves the server doing something other than what
the implicit contract suggested it ought to, but I don't think it's a
really serious violation in the same sense as letting the server cd
into ".." or overwrite files of arbitrary name would be. In this case
it can only leave a downloaded thing in the specific place you already
authorised it to put _some_ downloaded thing - it's just returned you
a directory in place of a file.
This commit is contained in:
Simon Tatham 2018-10-23 18:05:58 +01:00
parent c31e3cd437
commit 18d7998008
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
pscp.c
View File

@ -1456,6 +1456,10 @@ int scp_get_sink_action(struct scp_sink_action *act)
case 'C': case 'C':
case 'D': case 'D':
act->action = (action == 'C' ? SCP_SINK_FILE : SCP_SINK_DIR); act->action = (action == 'C' ? SCP_SINK_FILE : SCP_SINK_DIR);
if (act->action == SCP_SINK_DIR && !recursive) {
bump("security violation: remote host attempted to create "
"a subdirectory in a non-recursive copy!");
}
break; break;
default: default:
bump("Protocol error: Expected control record"); bump("Protocol error: Expected control record");