Allowed filenames

"Mark Peloquin" <[email protected]> Wed, 11 Apr 2007 01:10:06 -0500
Newsgroups gmane.comp.djb.publicfile
Message-ID <[email protected]>
I noticed that filenames with spaces aren't listed in FTP sessions
with publicfile.  I was able to chdir into directories whose names
contain spaces by typing the directory name in manually.  It works the
same with any files.  I found that in fetch.c where filenames were
being screened, and I cannot agree with it.  Here's my change to it:

diff -u publicfile-0.52/fetch.c publicfile-0.52_new/fetch.c
--- publicfile-0.52/fetch.c     1999-11-09 01:23:46.000000000 -0600
+++ publicfile-0.52_new/fetch.c 2007-04-10 23:26:30.000000000 -0500
@@ -66,7 +66,7 @@

   if (fn[0] == '.') return;
   for (i = 0;fn[i];++i) {
-    if ((fn[i] >= 0) && (fn[i] <= 32)) return;
+    if (((fn[i] >= 0) && (fn[i] < 32) || fn[i] == 127)) return;
     if (fn[i] == '~') return;
   }

It seems to work, though I have had time to only test this with
seamonkey.  It looks like the code was screening out control
characters, but 0x20 is not a control character.  However, 0x7f is (it
is DEL).

This isn't some obscure security precaution that I'm simply not aware
of, is it?  I searched RFC 959 but found only this:  "FTP does not yet
specify a standard pathname convention.  Each user must follow the
file naming conventions of the file systems involved in the transfer."

Mark Peloquin