Opened 14 years ago

Last modified 14 years ago

#929 closed Bug report

Security issue: Invalid folder names created in file system

Reported by: silversword411 Owned by:
Priority: normal Component: FileZilla Server
Keywords: Cc: silversword411, Tim Kosse
Component version: Operating system type:
Operating system version:

Description

This seems to be an issue that should at least have an
option available to block invalid folder/files from
being created in the servers file system. Here is an
example of the folder names that were created (full log
file also attached):

(000025) 8/11/2005 16:44:46 - anonymous (84.97.64.36)>
MKD uploads/ /ÿÿk 97536ÿÿÿÿÿÿÿÿÿÿ/
(000025) 8/11/2005 16:44:46 - anonymous (84.97.64.36)>
257 Directory created successfully
(000025) 8/11/2005 16:44:46 - anonymous (84.97.64.36)>
MKD uploads/ /ÿÿk 97536ÿÿÿÿÿÿÿÿÿÿ/ÿÿÿÿÿÿÿÿÿt 22241ÿÿÿÿ/
(000025) 8/11/2005 16:44:46 - anonymous (84.97.64.36)>
257 Directory created successfully
(000025) 8/11/2005 16:44:46 - anonymous (84.97.64.36)>
MKD uploads/ /ÿÿk 97536ÿÿÿÿÿÿÿÿÿÿ/ÿÿÿÿÿÿÿÿÿt
22241ÿÿÿÿ/ÿÿÿÿÿÿÿÿÿP 63612ÿÿÿÿÿÿÿÿÿÿ/
(000025) 8/11/2005 16:44:46 - anonymous (84.97.64.36)>
257 Directory created successfully

Note that folders were created with spaces thruout the
name were created. Attempting to delete these folders
via standard windows file managers cause errors.

Only method I was able to find to delete the folders
was to use rmdir from command prompt on the parent
folder (uploads).

Thanks,
David Troesch

Change History (2)

comment:1 Changed 14 years ago by Tim Kosse

FileZilla only uses the function Windows itself provides. If
standard file managers can't delete them, I think the
standard file managers are broken.

comment:2 Changed 14 years ago by silversword411

I'm wondering if these folders are allowed to be created
with the windows API's because they are unicode compliant.
As an English version of XP here though, I don't want
unicode folders allowed because if you don't the folder
support loaded then it causes problems.

Maybe an option to block non-english folders would be a
feasable, reasonable workaround?

David Troesch

Note: See TracTickets for help on using tickets.