Nick Craig-Wood 52cf74dc59 sftp: fix cmd shell execution of paths containing variable-expansion or newline characters ...

An audit of the shell escaping alongside the PowerShell fix found the
Windows Command Prompt path only rejected the double quote delimiter. A
remote filename containing % or ! can trigger environment variable expansion
even inside double quotes, and a newline or carriage return ends the
command, so a crafted filename could alter the command run during
server-side hashing. Reject paths containing these characters, matching
the existing treatment of the double quote.

2026-07-31 13:21:59 +01:00

..

sftp_internal_test.go

sftp: fix cmd shell execution of paths containing variable-expansion or newline characters

2026-07-31 13:21:59 +01:00

sftp_test.go

build: remove build constraint syntax for go 1.16 and older

2024-04-18 16:53:55 +02:00

sftp_unsupported.go

build: fix linting issues reported by running golangci-lint with different GOOS

2024-04-22 19:29:12 +02:00

sftp.go

sftp: fix cmd shell execution of paths containing variable-expansion or newline characters

2026-07-31 13:21:59 +01:00

ssh_external_test.go

sftp: fix zombie SSH processes with --sftp-ssh - Fixes #8929

2025-11-04 12:09:47 +00:00

ssh_external.go

sftp: fix zombie SSH processes with --sftp-ssh - Fixes #8929

2025-11-04 12:09:47 +00:00

ssh_internal.go

sftp: add --sftp-http-proxy to connect via HTTP CONNECT proxy

2025-04-29 14:16:17 +01:00

ssh.go

build: remove build constraint syntax for go 1.16 and older

2024-04-18 16:53:55 +02:00

stringlock_test.go

build: modernize Go usage

2025-02-28 11:31:14 +00:00

stringlock.go

build: remove build constraint syntax for go 1.16 and older

2024-04-18 16:53:55 +02:00