Windows: User can escape from root directory

[yetanothernickname]

Windows, default File System, root directory set in login event callback. User can browse parent directory using /../../ in URL.
Example:
root: 'X:\\Project\\Storage\\User'

URL ftp://127.0.0.1/../../ becomes a command CWD \/../../

At line 30 in fs.js we have nodePath.resolve('X:\Project\Storage\User', '.\\\..\..\')

So _resolvePath() returns

{
  clientPath: '\\..\..\',
  fsPath: 'X:\Project'
}

[trs]

This must be a bug on windows. I’ll have to investigate.

There is a specific test to ensure users cannot escape the root directory: https://github.com/trs/ftp-srv/blob/master/test/fs.spec.js#L65

The clientPath is passed through normalize which would resolve any . and ...
For example, in the test case, attempting to change directory to ../../../../../../../../../../.. would result in a clientPath (the path the client is actually shown) as /. Whereas the fsPath (the actual path on the server) would resolve to the root.

[yetanothernickname]

Notice the backslash in the CWD command. I can't explain it, but..

const path = require('path');
console.log(path.normalize('\\/../../../../'));

Linux:
../../../

Windows:
\\..\..\

[trs]

Trying this on windows I can't recreate it using Filezilla, Firefox, or Edge. What client are you using?

But in the next PR I have removed the added separator when joining paths, this should solve your issue.

[yetanothernickname]

Firefox. Demo
I have a suspicion that this module is not designed to work with URLs...

[trs]

Thanks for the demo video. The attached PR (#168) should address this issue. I'll work on getting it released soon.

[yetanothernickname]

You can see how #168 works in this video :)

[trs]

@yetanothernickname You used #168 for that video?

[yetanothernickname]

@trs Yes, with new fsPath()

[matt-forster]

I'd like to see if we can confirm this is still the case with the changes we made because it shouldn't be.

[n-timofeev]

@forstermatth I was able to reproduce it on 4cd88b1

[matt-forster]

@n-timofeev Thanks, I will take a look this week.

[botovance]

🎉 This issue has been resolved in version 4.4.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀

[n-timofeev]

Still not fixed or i'am doing something wrong...
demo1, demo2

[matt-forster]

Hey @n-timofeev, could you confirm the version in the lock file you have in those videos?

I see you step through the new resolve in the second one, enough proof for me, apologies.

[matt-forster]

I've got PR #232 setup to test windows in our CI environment - I've also added a test that uses the path as is in your demo videos.

There are a lot of tests failing in that branch right now, mostly due to tests expecting Unix output. This should get us on the right track to fixing this without a doubt.

[matt-forster]

GHSA-pmw4-jgxx-pcq9

[n-timofeev]

Source of backslash
Server sends it in response to the PWD command and then Firefox prepend it in CWD

And i think, we need to block paths with sequential dots and slashes here as a temporary solution

[antonilol]

@heartz66 making symlinks in you ftp folder is you own choice and cannot be done on the client side