feat(p5-remote-option): --remote-option (probe 2.14.0), --trust-sender

src/server/receiver.c

@@ -3,6 +3,7 @@
 #include "chunk.h"
 #include "config.h"
 #include "delay_updates.h"
+#include "file.h"
 #include "file_receive.h"
 #include "log.h"
 #include "metadata.h"
@@ -92,7 +93,11 @@ static bool receiver_process_batch(Config* config, int file_descriptor) {
       send_status(file_descriptor, STATUS_ERROR);
       return false;
     }
-    if (!utils_valid_batch_path(check_path)) {
+    /* --trust-sender: accept a ``..``/absolute check path (a trusted sender's
+         odd-but-legit entry) and defer containment to the secure stat below;
+         an empty path is still always rejected. */
+    if (check_path[0] == '\0' ||
+        (!file_get_trust_sender() && !utils_valid_batch_path(check_path))) {
       free(check_path);
       send_status(file_descriptor, STATUS_ERROR);
       return false;

src/server/server.c

@@ -220,6 +220,12 @@ void handler(int file_descriptor) {
      fd-walk reads a stable value during the whole transfer (and never bleeds
      across the per-connection forked processes). */
   file_set_keep_dirlinks(config->keep_dirlinks);
+  /* --trust-sender is a LOCAL receiver policy: it never crosses the wire (so a
+     wire peer can never enable it), the receiving process applies it here from
+     its own config.  Set before any multithreaded receiver/writer threads are
+     spawned so the fd-walk reads a stable value during the whole transfer, and
+     never bleeds across the per-connection forked processes.  Off by default. */
+  file_set_trust_sender(config->trust_sender);
   if (config->use_multithreading) {
     Queue* q = queue_create(100, file_destroy);
     if (q == NULL) {