[openssh-commits] [openssh] 04/08: upstream: avoid download to server-controlled path when performing

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit 1b39f39657d2e58f8ec57341581a39bbf0be645b
Author: djm at openbsd.org <djm at openbsd.org>
AuthorDate: Mon Jun 29 01:47:21 2026 +0000

    upstream: avoid download to server-controlled path when performing
    
    download on the commandline. From Swival scanner
    
    OpenBSD-Commit-ID: d1b2c44305fdfe6d51eed9ecc727e59478bf311f
---
 sftp.c | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

diff --git a/sftp.c b/sftp.c
index 0ab9206c2..0b57e0833 100644
--- a/sftp.c
+++ b/sftp.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sftp.c,v 1.251 2026/05/31 04:51:45 djm Exp $ */
+/* $OpenBSD: sftp.c,v 1.252 2026/06/29 01:47:21 djm Exp $ */
 /*
  * Copyright (c) 2001-2004 Damien Miller <djm at openbsd.org>
  *
@@ -2289,13 +2289,8 @@ interactive_loop(struct sftp_conn *conn, char *file1, char *file2)
 				return (-1);
 			}
 		} else {
-			/* XXX this is wrong wrt quoting */
-			snprintf(cmd, sizeof cmd, "get%s %s%s%s",
-			    global_aflag ? " -a" : "", dir,
-			    file2 == NULL ? "" : " ",
-			    file2 == NULL ? "" : file2);
-			err = parse_dispatch_command(conn, cmd,
-			    &remote_path, startdir, 1, 0);
+			err = process_get(conn, dir, file2, remote_path, 0, 0,
+			    global_aflag, 0);
 			free(dir);
 			free(startdir);
 			free(remote_path);

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.