Security: Scanner follows symlinks and can traverse outside source tree #192

New Issue

2026-07-30T18:34:46+02:00

TapTap commented

2026-07-30 18:34:46 +02:00

Severity: medium
Category: security
Location: src/client/scanner.c:102-109

Description:
directory_scanner_next() uses stat() instead of lstat(). This causes two problems:

Symlinks are followed transparently. A symlink in the source tree can point outside the source directory, causing the client to read and transfer files it was not asked to access.
A symlink cycle can cause infinite recursion and stack exhaustion during directory traversal.

Suggested fix:

Use lstat() to identify symlinks.
Add a --links / -l option (see feature issue) to preserve symlinks as symlinks instead of following them.
Until symlink preservation is implemented, detect symlinks and skip them by default, or follow them with a depth/recursion limit and cycle detection.

Labels: security, traversal

**Severity:** medium **Category:** security **Location:** `src/client/scanner.c:102-109` **Description:** `directory_scanner_next()` uses `stat()` instead of `lstat()`. This causes two problems: 1. Symlinks are followed transparently. A symlink in the source tree can point outside the source directory, causing the client to read and transfer files it was not asked to access. 2. A symlink cycle can cause infinite recursion and stack exhaustion during directory traversal. **Suggested fix:** 1. Use `lstat()` to identify symlinks. 2. Add a `--links` / `-l` option (see feature issue) to preserve symlinks as symlinks instead of following them. 3. Until symlink preservation is implemented, detect symlinks and skip them by default, or follow them with a depth/recursion limit and cycle detection. **Labels:** security, traversal

TapTap added the security needs-triage labels 2026-07-30 18:34:46 +02:00

TapTap referenced this issue from a commit

2026-07-30 18:49:31 +02:00

fix: security issues #192 #191 #190 #189 #188 #187

TapTap referenced this issue from a commit

2026-07-30 19:05:21 +02:00

fix: security #192 #187, bugs #194 #193, quality #195, features #174-#186

TapTap referenced this issue

2026-07-30 19:15:40 +02:00

Batch fix: security, bugs, quality, and features (v2) #198

TapTap closed this issue

2026-07-30 19:38:27 +02:00