Mirrors/sftpgo
1
0
Fork 0
mirror of https://github.com/drakkan/sftpgo.git synced 2025-12-07 14:50:55 +03:00
Code Issues Packages Projects Releases Wiki Activity

sftp setstat: guard against empty attrs

Browse Source 
It seems that there are some clients that sends Setstat requests with
no attrs:

https://github.com/pkg/sftp/issues/325

I haven't never seen this myself, anyway we now return ErrSSHFxBadMessage
and log the client version in such cases
This commit is contained in:
Nicola Murino
2019-12-04 08:31:47 +01:00
parent 80a5138115
commit 39fc9b73e9
2 changed files with 11 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
sftpd/handler.go
View File

@@ -261,6 +261,11 @@ func (c Connection) handleSFTPSetstat(path string, request *sftp.Request) error
if setstatMode == 1 { if setstatMode == 1 {
return nil return nil
} }
if len(request.Attrs) < 1 {
c.Log(logger.LevelInfo, logSender, "cannot handle Setstat request with no attrs, this is probably a buggy client: %v",
c.ClientVersion)
return sftp.ErrSSHFxBadMessage
}
attrFlags := request.AttrFlags() attrFlags := request.AttrFlags()
if attrFlags.Permissions { if attrFlags.Permissions {
if !c.User.HasPerm(dataprovider.PermChmod) { if !c.User.HasPerm(dataprovider.PermChmod) {

6
sftpd/internal_test.go
View File

@@ -227,6 +227,12 @@ func TestSetstatModeIgnore(t *testing.T) {
if err != nil { if err != nil {
t.Errorf("unexpected error: %v setstat should be silently ignore in mode 1", err) t.Errorf("unexpected error: %v setstat should be silently ignore in mode 1", err)
} }
setstatMode = 0
req := sftp.NewRequest("Setstat", "invalid")
err = connection.handleSFTPSetstat("invalid", req)
if err != sftp.ErrSSHFxBadMessage {
t.Errorf("unexpected error: %v", err)
}
setstatMode = originalMode setstatMode = originalMode
} }