mirror of
https://git.tartarus.org/simon/putty.git
synced 2025-01-25 01:02:24 +00:00
2675f9578d
This commit adds sanitisation to PSCP and PSFTP in the same style as I've just put it into Plink. This time, standard error is sanitised without reference to whether it's redirected (at least unless you give an override option), on the basis that where Plink is _sometimes_ an SSH transport for some other protocol, PSCP and PSFTP _always_ are. But also, the sanitiser is run over any remote filename sent by the server, substituting ? for any control characters it finds. That removes another avenue for the server to deliberately confuse the display. This commit fixes our bug 'pscp-unsanitised-server-output', aka the two notional 'vulnerabilities' CVE-2019-6109 and CVE-2019-6110. (Although we regard those in isolation as only bugs, not serious vulnerabilities, because their main threat was in hiding the evidence of a server having exploited other more serious vulns that we never had.) |
||
|---|---|---|
| .. | ||
| blurb.but | ||
| chm.css | ||
| config.but | ||
| errors.but | ||
| faq.but | ||
| feedback.but | ||
| gs.but | ||
| index.but | ||
| intro.but | ||
| Makefile | ||
| man-pag.but | ||
| man-pg.but | ||
| man-pl.but | ||
| man-pscp.but | ||
| man-psft.but | ||
| man-ptel.but | ||
| man-pter.but | ||
| man-putt.but | ||
| mancfg.but | ||
| manpages.but | ||
| pageant.but | ||
| pgpkeys.but | ||
| plink.but | ||
| pscp.but | ||
| psftp.but | ||
| pubkey.but | ||
| site.but | ||
| sshnames.but | ||
| udp.but | ||
| using.but | ||
| vids.but | ||