[jira] [Commented] (SSHD-605) VirtualFileSystemFactory allows escaping from root
[ https://issues.apache.org/jira/browse/SSHD-605?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15236659#comment-15236659 ] Guillaume Nodet commented on SSHD-605: -- You're definitely welcome to fix this problem. You can either attach a patch to this jira issue or create a git pull request using the apache mirror at github. > VirtualFileSystemFactory allows escaping from root > -- > > Key: SSHD-605 > URL: https://issues.apache.org/jira/browse/SSHD-605 > Project: MINA SSHD > Issue Type: Bug >Affects Versions: 1.0.0 > Environment: Windows, JDK 7 >Reporter: Damien B >Assignee: Goldstein Lyor > Labels: security > Fix For: 1.1.0 > > > Possibly Windows only. > I start a SFTP server like this: > sshd = SshServer.setUpDefaultServer(); > [...] > sshd.setFileSystemFactory(new > VirtualFileSystemFactory(myRootDir.getCanonicalPath())); > [...] > sshd.setSubsystemFactories(Arrays.>asList(new > SftpSubsystemFactory())); > I connect to the server with FileZilla. > Upon connexion, the files in myRooDir correctly appear under the server path > '/'. But if I cd to '/c:/Windows/', the files in C:\Windows\ appear, escaping > the VFS root. -- This message was sent by Atlassian JIRA (v6.3.4#6332)
[jira] [Commented] (SSHD-605) VirtualFileSystemFactory allows escaping from root
[ https://issues.apache.org/jira/browse/SSHD-605?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15236286#comment-15236286 ] Albert Ho commented on SSHD-605: Hi all, I took a look at the fix for this ticket and verified that the bug still exists in Apache SSHD 1.1.0 and 1.2.0. I have a fix for this ticket locally, including extensive unit tests on the RootedFileSystemProvider. I would be happy to take this on (assuming my employer authorizes it). You can follow the thread here: http://www.mail-archive.com/dev@mina.apache.org/msg26592.html > VirtualFileSystemFactory allows escaping from root > -- > > Key: SSHD-605 > URL: https://issues.apache.org/jira/browse/SSHD-605 > Project: MINA SSHD > Issue Type: Bug >Affects Versions: 1.0.0 > Environment: Windows, JDK 7 >Reporter: Damien B >Assignee: Goldstein Lyor > Labels: security > Fix For: 1.1.0 > > > Possibly Windows only. > I start a SFTP server like this: > sshd = SshServer.setUpDefaultServer(); > [...] > sshd.setFileSystemFactory(new > VirtualFileSystemFactory(myRootDir.getCanonicalPath())); > [...] > sshd.setSubsystemFactories(Arrays.>asList(new > SftpSubsystemFactory())); > I connect to the server with FileZilla. > Upon connexion, the files in myRooDir correctly appear under the server path > '/'. But if I cd to '/c:/Windows/', the files in C:\Windows\ appear, escaping > the VFS root. -- This message was sent by Atlassian JIRA (v6.3.4#6332)
Re: VirtualFileSystem able to mkdir and chdir to non rooted directory
Thanks Elijah, will do and will send an update along.
On Mon, Apr 11, 2016 at 9:50 AM, elijah baley wrote:
> Will have to investigate (this will take time). Since you say you have
> unit tests the reproduce the problem, you can debug the code and see
> exactly why it happens. I recommend you do it with the source code for 1.2
> which is the latest one. Once you find the problem, please re-open SSHD-601
> and attache the patch...
>
> > Date: Mon, 11 Apr 2016 09:20:15 -0700
> > Subject: Re: VirtualFileSystem able to mkdir and chdir to non rooted
> directory
> > From: a...@linkedin.com.INVALID
> > To: dev@mina.apache.org
> >
> > Thanks Elijah, I should have stated that I'm using version 1.1.0 on El
> > Capitan v 10.11.3:
> >
> > $ md5 sshd-core-1.1.0.jar
> > MD5 (sshd-core-1.1.0.jar) = 6e94f5cd80de88ddaaa80bb2ff3fa793
> >
> > I've written some unit tests (that's how I discovered the issue) on our
> end
> > here to check to see that an InvalidPathException is thrown using the
> code
> > above (it can be cleaned up, but is mostly the same).
> >
> > Maybe my version is out of date or there is still an issue?
> >
> > On Sat, Apr 9, 2016 at 12:45 AM, elijah baley
> wrote:
> >
> > > This has been fixed in version 1.1 and up via SSHD-605
> > >
> > > > Date: Fri, 8 Apr 2016 15:48:10 -0700
> > > > Subject: VirtualFileSystem able to mkdir and chdir to non rooted
> > > directory
> > > > From: a...@linkedin.com.INVALID
> > > > To: dev@mina.apache.org
> > > >
> > > > Hi SSHD team,
> > > >
> > > > Not sure if this is a bug or not, but when I instantiate a new
> FileSystem
> > > > using the VirtualFileSystemFactory and RootedFileSystemProvider, as a
> > > user
> > > > on the box, I am able to mkdir and get/put files in parent (i.e.
> > > > non-subpath) paths of the supposed "root" if I do something like
> > > >
> > > > sftp> pwd
> > > > Remote working directory: /
> > > >
> > > > $ put ../thisismyfile
> > > >
> > > > It seems like the resolveLocalPath which is supposed to throw an
> > > > InvalidPathException if the path is not a proper subpath of the
> rooted
> > > file
> > > > system needs to normalize the path in addition to doing it's nullity
> > > > checks. I was able to prevent this behavior by doing something like
> > > this,
> > > > but not sure if this is the best approach.
> > > >
> > > > Any guidance/explanation would be appreciated. Thanks.
> > > >
> > > > public class FixedRootedFileSystemProvider extends
> > > RootedFileSystemProvider {
> > > >
> > > > private static final Logger LOG =
> > > > LoggerFactory.getLogger(FixedRootedFileSystemProvider.class);
> > > >
> > > > public FixedRootedFileSystemProvider() { super(); }
> > > >
> > > > @Override
> > > > protected Path resolveLocalPath(RootedPath path) {
> > > > Path resolvedLocalPath = super.resolveLocalPath(path);
> > > > return validateParent(path, resolvedLocalPath);
> > > > }
> > > >
> > > > private Path validateParent(RootedPath path, Path localPath) throws
> > > > InvalidPathException {
> > > > RootedFileSystem rfs = path.getFileSystem();
> > > > Path root = rfs.getRoot();
> > > >
> > > > if
> > >
> (!localPath.toAbsolutePath().normalize().startsWith(root.toAbsolutePath().normalize()))
> > > > { //i.e. is not a REAL subpath
> > > > LOG.info("{} is not a subpath of the root FS path " +
> > > > root.toAbsolutePath().normalize(),
> > > > localPath.toAbsolutePath().normalize());
> > > > throw new InvalidPathException(localPath.toString(), "Invalid
> > > path");
> > > > }
> > > > return localPath;
> > > > }
> > > > }
> > >
> > >
>
>
RE: VirtualFileSystem able to mkdir and chdir to non rooted directory
Will have to investigate (this will take time). Since you say you have unit
tests the reproduce the problem, you can debug the code and see exactly why it
happens. I recommend you do it with the source code for 1.2 which is the latest
one. Once you find the problem, please re-open SSHD-601 and attache the patch...
> Date: Mon, 11 Apr 2016 09:20:15 -0700
> Subject: Re: VirtualFileSystem able to mkdir and chdir to non rooted directory
> From: a...@linkedin.com.INVALID
> To: dev@mina.apache.org
>
> Thanks Elijah, I should have stated that I'm using version 1.1.0 on El
> Capitan v 10.11.3:
>
> $ md5 sshd-core-1.1.0.jar
> MD5 (sshd-core-1.1.0.jar) = 6e94f5cd80de88ddaaa80bb2ff3fa793
>
> I've written some unit tests (that's how I discovered the issue) on our end
> here to check to see that an InvalidPathException is thrown using the code
> above (it can be cleaned up, but is mostly the same).
>
> Maybe my version is out of date or there is still an issue?
>
> On Sat, Apr 9, 2016 at 12:45 AM, elijah baley wrote:
>
> > This has been fixed in version 1.1 and up via SSHD-605
> >
> > > Date: Fri, 8 Apr 2016 15:48:10 -0700
> > > Subject: VirtualFileSystem able to mkdir and chdir to non rooted
> > directory
> > > From: a...@linkedin.com.INVALID
> > > To: dev@mina.apache.org
> > >
> > > Hi SSHD team,
> > >
> > > Not sure if this is a bug or not, but when I instantiate a new FileSystem
> > > using the VirtualFileSystemFactory and RootedFileSystemProvider, as a
> > user
> > > on the box, I am able to mkdir and get/put files in parent (i.e.
> > > non-subpath) paths of the supposed "root" if I do something like
> > >
> > > sftp> pwd
> > > Remote working directory: /
> > >
> > > $ put ../thisismyfile
> > >
> > > It seems like the resolveLocalPath which is supposed to throw an
> > > InvalidPathException if the path is not a proper subpath of the rooted
> > file
> > > system needs to normalize the path in addition to doing it's nullity
> > > checks. I was able to prevent this behavior by doing something like
> > this,
> > > but not sure if this is the best approach.
> > >
> > > Any guidance/explanation would be appreciated. Thanks.
> > >
> > > public class FixedRootedFileSystemProvider extends
> > RootedFileSystemProvider {
> > >
> > > private static final Logger LOG =
> > > LoggerFactory.getLogger(FixedRootedFileSystemProvider.class);
> > >
> > > public FixedRootedFileSystemProvider() { super(); }
> > >
> > > @Override
> > > protected Path resolveLocalPath(RootedPath path) {
> > > Path resolvedLocalPath = super.resolveLocalPath(path);
> > > return validateParent(path, resolvedLocalPath);
> > > }
> > >
> > > private Path validateParent(RootedPath path, Path localPath) throws
> > > InvalidPathException {
> > > RootedFileSystem rfs = path.getFileSystem();
> > > Path root = rfs.getRoot();
> > >
> > > if
> > (!localPath.toAbsolutePath().normalize().startsWith(root.toAbsolutePath().normalize()))
> > > { //i.e. is not a REAL subpath
> > > LOG.info("{} is not a subpath of the root FS path " +
> > > root.toAbsolutePath().normalize(),
> > > localPath.toAbsolutePath().normalize());
> > > throw new InvalidPathException(localPath.toString(), "Invalid
> > path");
> > > }
> > > return localPath;
> > > }
> > > }
> >
> >
Re: VirtualFileSystem able to mkdir and chdir to non rooted directory
Thanks Elijah, I should have stated that I'm using version 1.1.0 on El
Capitan v 10.11.3:
$ md5 sshd-core-1.1.0.jar
MD5 (sshd-core-1.1.0.jar) = 6e94f5cd80de88ddaaa80bb2ff3fa793
I've written some unit tests (that's how I discovered the issue) on our end
here to check to see that an InvalidPathException is thrown using the code
above (it can be cleaned up, but is mostly the same).
Maybe my version is out of date or there is still an issue?
On Sat, Apr 9, 2016 at 12:45 AM, elijah baley wrote:
> This has been fixed in version 1.1 and up via SSHD-605
>
> > Date: Fri, 8 Apr 2016 15:48:10 -0700
> > Subject: VirtualFileSystem able to mkdir and chdir to non rooted
> directory
> > From: a...@linkedin.com.INVALID
> > To: dev@mina.apache.org
> >
> > Hi SSHD team,
> >
> > Not sure if this is a bug or not, but when I instantiate a new FileSystem
> > using the VirtualFileSystemFactory and RootedFileSystemProvider, as a
> user
> > on the box, I am able to mkdir and get/put files in parent (i.e.
> > non-subpath) paths of the supposed "root" if I do something like
> >
> > sftp> pwd
> > Remote working directory: /
> >
> > $ put ../thisismyfile
> >
> > It seems like the resolveLocalPath which is supposed to throw an
> > InvalidPathException if the path is not a proper subpath of the rooted
> file
> > system needs to normalize the path in addition to doing it's nullity
> > checks. I was able to prevent this behavior by doing something like
> this,
> > but not sure if this is the best approach.
> >
> > Any guidance/explanation would be appreciated. Thanks.
> >
> > public class FixedRootedFileSystemProvider extends
> RootedFileSystemProvider {
> >
> > private static final Logger LOG =
> > LoggerFactory.getLogger(FixedRootedFileSystemProvider.class);
> >
> > public FixedRootedFileSystemProvider() { super(); }
> >
> > @Override
> > protected Path resolveLocalPath(RootedPath path) {
> > Path resolvedLocalPath = super.resolveLocalPath(path);
> > return validateParent(path, resolvedLocalPath);
> > }
> >
> > private Path validateParent(RootedPath path, Path localPath) throws
> > InvalidPathException {
> > RootedFileSystem rfs = path.getFileSystem();
> > Path root = rfs.getRoot();
> >
> > if
> (!localPath.toAbsolutePath().normalize().startsWith(root.toAbsolutePath().normalize()))
> > { //i.e. is not a REAL subpath
> > LOG.info("{} is not a subpath of the root FS path " +
> > root.toAbsolutePath().normalize(),
> > localPath.toAbsolutePath().normalize());
> > throw new InvalidPathException(localPath.toString(), "Invalid
> path");
> > }
> > return localPath;
> > }
> > }
>
>
[jira] [Comment Edited] (SSHD-641) PUTTY: incoming packet was garbled on decryption
[ https://issues.apache.org/jira/browse/SSHD-641?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15234784#comment-15234784 ] Wolfgang Glas edited comment on SSHD-641 at 4/11/16 9:23 AM: - We' tried this in our premises under Windows 7 and have the following mileage: putty-0.65 -> sshd-1.1.0 incoming packet was garbled on decryption putty-0.65 -> sshd-1.2.0 SSH connection stable putty-0.67 -> sshd-1.2.0 SSH connection stable We haven't tried other combinations and sshd versions. was (Author: wolfgang.g...@ev-i.at): We' tried this in our premises under Windows 7 and have the following mileage: putty-0.65 -> sshd-1.1.0 incoming packet was garbled on decryption putty-0.65 -> sshd-1.2.0 SSH conenction stable putty-0.67 -> sshd-1.2.0 SSH conenction stable We haven't tried other combinations and sshd versions. > PUTTY: incoming packet was garbled on decryption > > > Key: SSHD-641 > URL: https://issues.apache.org/jira/browse/SSHD-641 > Project: MINA SSHD > Issue Type: Bug >Affects Versions: 1.0.0, 1.1.0 >Reporter: Hooman Valibeigi > Attachments: sshd.log.zip > > > I had no issues with sshd-core 0.14.0 but ever since I upgraded to 1.0.0 and > 1.1.0 I keep getting "incoming packet was garbled on decryption" error when I > use PUTTY to paste a large script (around 4 KB) into the shell. CYGWIN > terminal works fine btw. > With 1.0.0 it happens all the time at somewhere around the middle of the > script. > With 1.1.0 it occurs but not all the time. -- This message was sent by Atlassian JIRA (v6.3.4#6332)
[jira] [Commented] (SSHD-641) PUTTY: incoming packet was garbled on decryption
[ https://issues.apache.org/jira/browse/SSHD-641?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15234784#comment-15234784 ] Wolfgang Glas commented on SSHD-641: We' tried this in our premises under Windows 7 and have the following mileage: putty-0.65 -> sshd-1.1.0 incoming packet was garbled on decryption putty-0.65 -> sshd-1.2.0 SSH conenction stable putty-0.67 -> sshd-1.2.0 SSH conenction stable We haven't tried other combinations and sshd versions. > PUTTY: incoming packet was garbled on decryption > > > Key: SSHD-641 > URL: https://issues.apache.org/jira/browse/SSHD-641 > Project: MINA SSHD > Issue Type: Bug >Affects Versions: 1.0.0, 1.1.0 >Reporter: Hooman Valibeigi > Attachments: sshd.log.zip > > > I had no issues with sshd-core 0.14.0 but ever since I upgraded to 1.0.0 and > 1.1.0 I keep getting "incoming packet was garbled on decryption" error when I > use PUTTY to paste a large script (around 4 KB) into the shell. CYGWIN > terminal works fine btw. > With 1.0.0 it happens all the time at somewhere around the middle of the > script. > With 1.1.0 it occurs but not all the time. -- This message was sent by Atlassian JIRA (v6.3.4#6332)
