Re: [PATCH] tftpd: strip leading slashes from the requested file name

Ali Ahmet Memis via busybox <[email protected]>
Newsgroups gmane.linux.busybox
Message-ID <[email protected]>
tftpd-hpa's model needs a list of directories to validate an absolute
path against. BusyBox tftpd does not currently have such an allowlist
model. DIR just chroots into a single directory, nothing else.

I went back to bug 4874, the one this patch closes. The reporter's
own expected behavior was: absolute path translated to the tftpd dir
(/vmlinuz -> /boot/vmlinuz), or rejected if it falls outside. That's
stripping, not reject, not validate-against-a-list. The 2012 fix
covered the chroot case, with DIR. This patch is the no-DIR half of
that same request.

So this isn't a design choice I'm picking on my own. It's finishing
what was already asked for in 2012.

Ali
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.