Severity: medium Category: security Location:src/client/scanner.c:102-109
Description: directory_scanner_next() uses stat() instead of lstat(). This causes two problems:
Symlinks are followed transparently. A symlink in the source tree can point outside the source directory, causing the client to read and transfer files it was not asked to access.
A symlink cycle can cause infinite recursion and stack exhaustion during directory traversal.
Suggested fix:
Use lstat() to identify symlinks.
Add a --links / -l option (see feature issue) to preserve symlinks as symlinks instead of following them.
Until symlink preservation is implemented, detect symlinks and skip them by default, or follow them with a depth/recursion limit and cycle detection.
Labels: security, traversal
**Severity:** medium
**Category:** security
**Location:** `src/client/scanner.c:102-109`
**Description:**
`directory_scanner_next()` uses `stat()` instead of `lstat()`. This causes two problems:
1. Symlinks are followed transparently. A symlink in the source tree can point outside the source directory, causing the client to read and transfer files it was not asked to access.
2. A symlink cycle can cause infinite recursion and stack exhaustion during directory traversal.
**Suggested fix:**
1. Use `lstat()` to identify symlinks.
2. Add a `--links` / `-l` option (see feature issue) to preserve symlinks as symlinks instead of following them.
3. Until symlink preservation is implemented, detect symlinks and skip them by default, or follow them with a depth/recursion limit and cycle detection.
**Labels:** security, traversal
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Severity: medium
Category: security
Location:
src/client/scanner.c:102-109Description:
directory_scanner_next()usesstat()instead oflstat(). This causes two problems:Suggested fix:
lstat()to identify symlinks.--links/-loption (see feature issue) to preserve symlinks as symlinks instead of following them.Labels: security, traversal