Security: --delete follows symlinks and may delete outside destination tree #162

New Issue

2026-07-29T18:35:46+02:00

TapTap commented

2026-07-29 18:35:46 +02:00

Description

delete_extras() in src/shared/utils.c:123-125 walks the destination tree and removes files/directories not present in the sender manifest. The helper delete_extras_walk() uses stat() (which follows symlinks) and unlink()/rmdir() on paths constructed by concatenating the root with manifest-relative entries. If the destination tree contains a symlink, the walker may follow it and delete files outside the intended destination directory.

Location

src/shared/utils.c:84-120 — delete_extras_walk() follows symlinks via stat() and deletes the target.
src/shared/file.c:521-539 — receive_manifest() feeds the manifest directly into delete_extras().

Suggested fix

Use lstat() instead of stat() and never follow symlinks during cleanup.
Open the destination root as a dirfd and use unlinkat(dirfd, ...) relative to it.
Optionally require --force before deleting directories, and count deletions for a --max-delete safety limit.

Severity

Medium

Category

security

This issue was automatically generated by the issue-creator agent.

## Description `delete_extras()` in `src/shared/utils.c:123-125` walks the destination tree and removes files/directories not present in the sender manifest. The helper `delete_extras_walk()` uses `stat()` (which follows symlinks) and `unlink()`/`rmdir()` on paths constructed by concatenating the root with manifest-relative entries. If the destination tree contains a symlink, the walker may follow it and delete files outside the intended destination directory. ## Location - `src/shared/utils.c:84-120` — `delete_extras_walk()` follows symlinks via `stat()` and deletes the target. - `src/shared/file.c:521-539` — `receive_manifest()` feeds the manifest directly into `delete_extras()`. ## Suggested fix 1. Use `lstat()` instead of `stat()` and never follow symlinks during cleanup. 2. Open the destination root as a dirfd and use `unlinkat(dirfd, ...)` relative to it. 3. Optionally require `--force` before deleting directories, and count deletions for a `--max-delete` safety limit. ## Severity Medium ## Category security --- _This issue was automatically generated by the issue-creator agent._

TapTap added the bug security needs-triage labels 2026-07-29 18:35:46 +02:00

TapTap referenced this issue from a commit

2026-07-29 18:52:09 +02:00

fix: resolve all security issues (#154, #156, #157, #159, #160, #161, #162, #170)

TapTap referenced this issue

2026-07-29 18:52:26 +02:00

fix: resolve all security issues (#154, #156, #157, #159, #160, #161, #162, #170) #172

TapTap referenced this issue

2026-07-29 19:29:55 +02:00

Comprehensive fix: security, bugs, refactoring, tests, and rsync parity features #173

TapTap closed this issue

2026-07-30 18:17:31 +02:00