[PATCH] sftp: avoid re-parsing server-controlled path in cd fallback

[manfred.kaiser at ssh-mitm.at]

Dear OpenSSH developers,

the attached patch fixes the sibling of the issue just fixed in commit
1b39f39657 ("avoid download to server-controlled path when performing
download on the commandline"). That commit fixed the file-download case
by calling process_get() directly instead of building and re-parsing a
"get ..." command string. The directory case (`sftp host:dir`) still
builds a "cd \"%s\"" string from the server's realpath response and
re-parses it, which a realpath containing a double quote breaks,
aborting the client with "Unterminated quoted argument".

This patch resolves and validates the target directory directly instead,
mirroring the existing I_CHDIR case.

Unlike the file-download case, this isn't a security report. A crafted
realpath can inject extra tokens into the re-parsed "cd" command, but
I_CHDIR only reads the first one, so nothing injected is ever acted on.
Worst case is the client aborting with a confusing error, not a
redirected write.

Manfred Kaiser
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-sftp-avoid-re-parsing-server-controlled-path-in-cd-f.patch
Type: text/x-patch
Size: 3546 bytes
Desc: not available
URL: <http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20260712/f9472201/attachment.bin>