Re: [PATCH] tftpd: strip leading slashes from the requested file name

I was pretty sure this patch covered it when I sent it. The gap you point out is real. It's just a separate issue from what this patch fixes.

If somebody does cd / && tftpd without a DIR then /etc/shadow becomes etc/shadow and still resolves to /etc/shadow. So this does not make a bad CWD safe.

The patch fixes the case where tftpd is already running from the directory it is supposed to serve. For example cd /srv/tftp && tftpd. The same applies when DIR or chroot is used since xchroot() already keeps the request inside the chroot.

I don't think the missing safe default should block this patch. That is existing behavior. Changing it would be a separate policy change.

The documented usage already passes a DIR. For example tftpd -l /files/to/serve and udpsvd ... tftpd /files/to/serve. The no-DIR case is the CWD fallback.

For safe_default_running_path() I'm not against a common helper. I would rather see a concrete proposal for the default first. Putting it in libbb.a would affect other users too.

In particular changing httpd so that / is rejected as the CWD fallback would be a behavior change on its own. I also don't think /var/www is an obvious BusyBox-wide default.

I'd keep that as a separate discussion from this patch.

Ali