Ftp-WG: Re: UTF-8 pathnames: pathname nature & length

    Date:        Tue, 21 May 2002 02:00:41 -0500
    From:        "Gregory A Lundberg" <[email protected]>
    Message-ID:  <[email protected]>


  | Consider: what will you do when you send a pathname containing the ASCII DEL
  | character, such as:
  | 
  | RETR myfile(%x7F)DELE myfile
  | 
  | where (%x7F) is the DEL character.
  | 
  | A compliant FTP server which implements command editing, as it is
  | *specifically* allowed to do by RFC 959, could interpret the DEL as "erase
  | line".

So?

  | That RETR command isn't a RETR command, it's a DELE command.

Yes, so what?

  | The black-hats love this sort of mistake.

No they don't.  If they could send that convoluted command, intending
it to be a DELE command, they could just have easily sent

	DELE myfile

The server can't be confused into doing a delete when it thought it
was doing a retrieval - either the line editing gets done before the
command is parsed, in which case what the parser sees is "DELE myfile"
and applies the same permission checks, etc that would be applied
anyway.

Or, the line editing only applies to the argument, after the parser
has veen invoked, in which case the server knows it is doing a RETR
command, but the file name will be "DELE myfile".

The only possible problem would be if the server were to try and fool
people into sending DELE commands, by making them believe that a
file exists with a name like that above that they could fetch.  What
the point of that would be I have no idea - if the server wants to
delete some file, it can just go ahead and delete the things...  (if it
doesn't have permission to do so, then the user instructing the server
to do it cannot work either).

There's no problem with any of this, beyond confusion caused by a
server that chooses to have implemented local line editing (though
where that is explicitly allowed by 959 I am not exactly sure, I
can't find it).

Anything can be in a pathname - the server can support files with those
names or not, as it chooses.   Nothing is an "invalid character"
as far as the protocol specs go, and nothing is about to be made one now.

kre

ps: I suggest that you give up on your ftp commands == telnet crusade,
aside from the lowest level of the protocol used, it just isn't so.