Files
rclone/fs
Nick Craig-Wood 53f972830c rc: stop global.* connection string options changing config CVE-2026-49980
A connection string can carry global.* options which change rclone's
process-wide configuration (e.g. global.http_proxy). This is
undesirable for the rc interface which was designed to have multiple
users or connections at once. The rc interface has the `_config`
mechanism for setting request scoped global config.

This blocks global.* options on all rc paths by marking the context as
a remote control request at the rc boundaries. fs.NewFs then skips
applying global.* to the process-wide config for a marked context.

The marker is reapplied in fs.CopyConfig, which is the call rclone
uses to detach context but keep config.

global.* options still apply to the individual backend they are set
on, exactly like override.* options; they just no longer leak into the
rest of the process. Remotes created directly on the command line are
unaffected as are remotes defined in the config file.

See: GHSA-qw24-gh76-8rvv
2026-06-05 15:21:01 +01:00
..
2025-02-28 11:31:14 +00:00
2025-02-28 11:31:14 +00:00
2025-09-15 12:45:57 +01:00
2025-10-21 18:56:06 +01:00
2025-10-21 18:56:06 +01:00
2025-02-28 11:31:14 +00:00
2023-10-23 15:43:55 +01:00
2018-08-21 10:58:59 +01:00
2025-11-03 14:44:39 +00:00
2026-04-24 17:20:18 +01:00
2026-05-01 17:15:20 +01:00