strstr(..) path traversal check is weak and has false positives #112

New Issue

2026-07-21T16:20:35+02:00

TapTap commented

2026-07-21 16:20:35 +02:00

Description

The code checks strstr(disk_path, "..") != NULL to block path traversal in three places (file.c:212-213, 220-221, 236-237, and 460-461). This is a weak check:

On some systems, unicode normalization can bypass it
Symlinks within the allowed path can indirectly traverse
A path like /foo/..bar/file contains ".." but is not traversal — this causes false positives
The check does not catch all encoding-based traversal attempts

Location

src/shared/file.c:212-213, 220-221, 236-237, 460-461

How to trigger

An attacker sends a crafted file path that bypasses the substring check. If successful, files can be written outside the destination directory.

Suggested Fix

Use realpath() to canonicalize the destination path and verify it starts with the root directory. Before that, the received path should be checked character-by-character to reject any path component that is exactly ".." (not substring).

Expected impact

Prevents arbitrary file write outside the destination directory.

Severity

high

Sub-Agent

security-screener (SC-1)

This issue was automatically generated by the issue-creator agent.

## Description The code checks `strstr(disk_path, "..") != NULL` to block path traversal in three places (`file.c:212-213`, `220-221`, `236-237`, and `460-461`). This is a weak check: - On some systems, unicode normalization can bypass it - Symlinks within the allowed path can indirectly traverse - A path like `/foo/..bar/file` contains ".." but is not traversal — this causes false positives - The check does not catch all encoding-based traversal attempts ## Location src/shared/file.c:212-213, 220-221, 236-237, 460-461 ## How to trigger An attacker sends a crafted file path that bypasses the substring check. If successful, files can be written outside the destination directory. ## Suggested Fix Use `realpath()` to canonicalize the destination path and verify it starts with the root directory. Before that, the received path should be checked character-by-character to reject any path component that is exactly ".." (not substring). ## Expected impact Prevents arbitrary file write outside the destination directory. ## Severity high ## Category security ## Sub-Agent security-screener (SC-1) --- _This issue was automatically generated by the issue-creator agent._

TapTap referenced this issue

2026-07-21 16:48:29 +02:00

Security hardening: path traversal, TLS verification, DOS protections (#112-#118) #138

TapTap closed this issue

2026-07-29 18:27:13 +02:00

TapTap commented

2026-07-29 18:27:31 +02:00