[Bug 15122] Potential vulnerability: rsync creates files outside the target directory
just subscribed for rsync-qa from bugzilla via rsync <[email protected]>
| Newsgroups | gmane.network.rsync.general |
|---|---|
| Message-ID | <[email protected]/> |
https://bugzilla.samba.org/show_bug.cgi?id=15122 --- Comment #2 from Wayne Davison <[email protected]> --- BTW, what happens in the test case you provided is that the generator creates TOPDIR and then TOPDIR/secret dirs before asking the sender to start a transfer of TOPDIR/secret/config. It then goes on to notice that topdir is present (since it uses stat) and that topdir/secret is an empty directory that is in the way of a symlink, so it replaces the dir with a symlink prior to the receiver doing its file-create work. If the topdirs had sorted in the opposite order, the symlink would have been replaced with a directory. -- You are receiving this mail because: You are the QA Contact for the bug. -- Please use reply-all for most replies to avoid omitting the mailing list. To unsubscribe or change options: https://lists.samba.org/mailman/listinfo/rsync Before posting, read: http://www.catb.org/~esr/faqs/smart-questions.html