Opened 19 years ago

Last modified 19 years ago

#929 closed Bug report

Security issue: Invalid folder names created in file system

Reported by: silversword411 Owned by:
Priority: normal Component: FileZilla Server
Keywords: Cc: silversword411, Tim Kosse
Component version: Operating system type:
Operating system version:

Description

This seems to be an issue that should at least have an
option available to block invalid folder/files from
being created in the servers file system. Here is an
example of the folder names that were created (full log
file also attached):

(000025) 8/11/2005 16:44:46 - anonymous (84.97.64.36)>
MKD uploads/ /ÿÿk 97536ÿÿÿÿÿÿÿÿÿÿ/
(000025) 8/11/2005 16:44:46 - anonymous (84.97.64.36)>
257 Directory created successfully
(000025) 8/11/2005 16:44:46 - anonymous (84.97.64.36)>
MKD uploads/ /ÿÿk 97536ÿÿÿÿÿÿÿÿÿÿ/ÿÿÿÿÿÿÿÿÿt 22241ÿÿÿÿ/
(000025) 8/11/2005 16:44:46 - anonymous (84.97.64.36)>
257 Directory created successfully
(000025) 8/11/2005 16:44:46 - anonymous (84.97.64.36)>
MKD uploads/ /ÿÿk 97536ÿÿÿÿÿÿÿÿÿÿ/ÿÿÿÿÿÿÿÿÿt
22241ÿÿÿÿ/ÿÿÿÿÿÿÿÿÿP 63612ÿÿÿÿÿÿÿÿÿÿ/
(000025) 8/11/2005 16:44:46 - anonymous (84.97.64.36)>
257 Directory created successfully

Note that folders were created with spaces thruout the
name were created. Attempting to delete these folders
via standard windows file managers cause errors.

Only method I was able to find to delete the folders
was to use rmdir from command prompt on the parent
folder (uploads).

Thanks,
David Troesch

Change History (2)

comment:1 by Tim Kosse, 19 years ago

FileZilla only uses the function Windows itself provides. If
standard file managers can't delete them, I think the
standard file managers are broken.

comment:2 by silversword411, 19 years ago

I'm wondering if these folders are allowed to be created
with the windows API's because they are unicode compliant.
As an English version of XP here though, I don't want
unicode folders allowed because if you don't the folder
support loaded then it causes problems.

Maybe an option to block non-english folders would be a
feasable, reasonable workaround?

David Troesch

Note: See TracTickets for help on using tickets.