Re: [PATCH] tftpd: strip leading slashes from the requested file name
Guillermo Rodriguez Garcia via busybox <[email protected]>
| Newsgroups | gmane.linux.busybox |
|---|---|
| Message-ID | <CABDcavZRxGiO5YF-PgOkAe4C4vN5Hugon=cn9sSrnjJf_Vrg2Q@mail.gmail.com> |
El mar, 18 ago 2026 a las 9:10, Ali Ahmet Memis (<[email protected]>) escribió: > > tftpd-hpa's model needs a list of directories to validate an absolute > path against. BusyBox tftpd does not currently have such an allowlist > model. DIR just chroots into a single directory, nothing else. > > I went back to bug 4874, the one this patch closes. The reporter's > own expected behavior was: absolute path translated to the tftpd dir > (/vmlinuz -> /boot/vmlinuz), or rejected if it falls outside. That's > stripping, not reject, not validate-against-a-list. That may be the reporter's expectation but that does not necessarily mean it's the right thing to do. The reporter's needs can be easily met by just passing /boot as a DIR. Your patch is equivalent to assuming "if not DIR is given, behave exactly as if DIR=<cwd>" was specified. I am not sure this should be the case. Guillermo Rodriguez Garcia [email protected] _______________________________________________ busybox mailing list [email protected] https://lists.busybox.net/mailman/listinfo/busybox