beenull/sftpgo-mirror
1
0
Fork 0
mirror of https://github.com/drakkan/sftpgo.git synced 2024-11-21 23:20:24 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 6

sftp setstat: guard against empty attrs

Browse source 
It seems that there are some clients that sends Setstat requests with
no attrs:

https://github.com/pkg/sftp/issues/325

I haven't never seen this myself, anyway we now return ErrSSHFxBadMessage
and log the client version in such cases
This commit is contained in:
Nicola Murino 2019-12-04 08:31:47 +01:00
parent 80a5138115
commit 39fc9b73e9
2 changed files with 11 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
sftpd/handler.go
View file

@ -261,6 +261,11 @@ func (c Connection) handleSFTPSetstat(path string, request *sftp.Request) error
if setstatMode == 1 {
return nil
}
if len(request.Attrs) < 1 {
c.Log(logger.LevelInfo, logSender, "cannot handle Setstat request with no attrs, this is probably a buggy client: %v",
c.ClientVersion)
return sftp.ErrSSHFxBadMessage
}
attrFlags := request.AttrFlags()
if attrFlags.Permissions {
if !c.User.HasPerm(dataprovider.PermChmod) {

6
sftpd/internal_test.go
View file

@ -227,6 +227,12 @@ func TestSetstatModeIgnore(t *testing.T) {
if err != nil {
t.Errorf("unexpected error: %v setstat should be silently ignore in mode 1", err)
}
setstatMode = 0
req := sftp.NewRequest("Setstat", "invalid")
err = connection.handleSFTPSetstat("invalid", req)
if err != sftp.ErrSSHFxBadMessage {
t.Errorf("unexpected error: %v", err)
}
setstatMode = originalMode
}