mirror of https://github.com/wolfSSL/wolfssh.git
3b43e485dd
- Add wolfSSH_SFTP_SetConfinePath and a separate sftpConfinePath, so the start path only says where a session begins, and only an explicit confinement root rejects out-of-tree requests. - Have GetAndCleanPath take the WOLFSSH and enforce the confinement root, resolving relative requests against the start path. - Factor the shared canonicalize-and-store work out of wolfSSH_SFTP_SetDefaultPath into CanonicalizePath and StorePath. - Give the echoserver -D to opt a session into confinement; without it the -d home directory only says where SFTP starts. - Document both settings, and the symlink and TOCTOU caveats, once in wolfsftp.h, noting the confinement root itself is trusted. - Cover the split in api.c, and in regress.c start a session in a subdirectory of the confinement root: a sibling of the start directory is reachable, anything above the root is not. Issue: ZD-22308 |
||
|---|---|---|
| .. | ||
| echoserver.c | ||
| echoserver.h | ||
| include.am | ||