Allowed filenames
"Mark Peloquin" <[email protected]> Wed, 11 Apr 2007 01:10:06 -0500
| Newsgroups | gmane.comp.djb.publicfile |
|---|---|
| Message-ID | <[email protected]> |
I noticed that filenames with spaces aren't listed in FTP sessions
with publicfile. I was able to chdir into directories whose names
contain spaces by typing the directory name in manually. It works the
same with any files. I found that in fetch.c where filenames were
being screened, and I cannot agree with it. Here's my change to it:
diff -u publicfile-0.52/fetch.c publicfile-0.52_new/fetch.c
--- publicfile-0.52/fetch.c 1999-11-09 01:23:46.000000000 -0600
+++ publicfile-0.52_new/fetch.c 2007-04-10 23:26:30.000000000 -0500
@@ -66,7 +66,7 @@
if (fn[0] == '.') return;
for (i = 0;fn[i];++i) {
- if ((fn[i] >= 0) && (fn[i] <= 32)) return;
+ if (((fn[i] >= 0) && (fn[i] < 32) || fn[i] == 127)) return;
if (fn[i] == '~') return;
}
It seems to work, though I have had time to only test this with
seamonkey. It looks like the code was screening out control
characters, but 0x20 is not a control character. However, 0x7f is (it
is DEL).
This isn't some obscure security precaution that I'm simply not aware
of, is it? I searched RFC 959 but found only this: "FTP does not yet
specify a standard pathname convention. Each user must follow the
file naming conventions of the file systems involved in the transfer."
Mark Peloquin