[Bug 15122] Potential vulnerability: rsync creates files outside the target directory
just subscribed for rsync-qa from bugzilla via rsync <[email protected]>
| Newsgroups | gmane.network.rsync.general |
|---|---|
| Message-ID | <[email protected]/> |
https://bugzilla.samba.org/show_bug.cgi?id=15122 --- Comment #3 from Aditya Basu <[email protected]> --- Apologies for the late response. It is definitely a bad idea to mix multi-case systems. However, note that even copying between case-honoring systems can have similar consequences, for ex. case-insensitive (icase) ZFS considers K (unicode kelvin sign) and k (alphabet) to be equivalent while icase ext4 does not. I agree with you analysis of the ordering. However, IMHO traversing symlinks at the target is not a wise choice. An *immediate* fix to this particular issue would be to prevent rsync for traversing symlinks at the target. However, a more *complete* fix should involve detecting collisions and stopping the copy. We're currently exploring different types of defenses for collisions. If you're interested, I will be happy to keep you in the loop. Finally, does it make sense to get a CVE number assigned? -- You are receiving this mail because: You are the QA Contact for the bug. -- Please use reply-all for most replies to avoid omitting the mailing list. To unsubscribe or change options: https://lists.samba.org/mailman/listinfo/rsync Before posting, read: http://www.catb.org/~esr/faqs/smart-questions.html