mina-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Goldstein Lyor (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (SSHD-775) SftpSubSystem::sendStatus leaks Exception information
Date Thu, 28 Sep 2017 16:35:00 GMT

    [ https://issues.apache.org/jira/browse/SSHD-775?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16184414#comment-16184414
] 

Goldstein Lyor commented on SSHD-775:
-------------------------------------

You are making some interesting points - can you attach some reference to some document/RFC/web
site that contains some widely-accepted guidelines as to what information can/should/shouldn't
be exposed by SFTP (or SCP for that matter...) ? We try to adhere to standards and best practices
as much as possible and this would be a significant step towards this goal.

> SftpSubSystem::sendStatus leaks Exception information
> -----------------------------------------------------
>
>                 Key: SSHD-775
>                 URL: https://issues.apache.org/jira/browse/SSHD-775
>             Project: MINA SSHD
>          Issue Type: Improvement
>    Affects Versions: 1.6.0
>            Reporter: Mark Ebbers
>            Priority: Minor
>              Labels: security
>
> I'm using SSHD-core 1.6.0 in my own Sftp server implementation and make use of the rooted
file-system. Now did I notice that a client did try to rename a file, which was no longer
available, and got a response with the substatus SSH_FX_NO_SUCH_FILE and the message ' Internal
NoSuchFileException: /srv/sftp/chroot/11738/file.txt'.
> As a client I now know the following two things:
> * The full path on the file-system.
> * The server was written in Java. (NoSuchFileException)
> I noticed that the SftpSubsystem.sendStatus(Buffer, int, Throwable) uses the SftpHelper.resolveStatusMessage()
method to create a message string to be send to the client without further checking what information
is inside the Exception message. 



--
This message was sent by Atlassian JIRA
(v6.4.14#64029)

Mime
View raw message