Re: [PATCH] tftpd: strip leading slashes from the requested file name
Ali Ahmet Memis via busybox <[email protected]>
| Newsgroups | gmane.linux.busybox |
|---|---|
| Message-ID | <[email protected]> |
tftpd-hpa's model needs a list of directories to validate an absolute path against. BusyBox tftpd does not currently have such an allowlist model. DIR just chroots into a single directory, nothing else. I went back to bug 4874, the one this patch closes. The reporter's own expected behavior was: absolute path translated to the tftpd dir (/vmlinuz -> /boot/vmlinuz), or rejected if it falls outside. That's stripping, not reject, not validate-against-a-list. The 2012 fix covered the chroot case, with DIR. This patch is the no-DIR half of that same request. So this isn't a design choice I'm picking on my own. It's finishing what was already asked for in 2012. Ali