Is sshd supposed to interpret "{a,b}" brace expansions?

[Damien Miller]

On Wed, 30 Jan 2019, Peter Simons wrote:

> Hi,
> 
> the proposed fix for CVE-2019-6111 [1] adds file name validation to scp
> to prevent the server from sending files that the client actually did
> not request.

That's _a_ proposed fix, but not the one we used.

Ours is:

https://anongit.mindrot.org/openssh.git/patch/?id=391ffc4b9

> Now, a consequence of that patch is that commands which
> contain server-side brace expansions such as
> 
>     $ scp remote:'/etc/{passwd,group}' .
>     error: unexpected filename: passwd
> 
> no longer work. Shell globs such as [abc], ?, *, and combinations
> thereof still work fine, but {a,b} does not.
> 
> Is that a shortcoming of the patch? Or is it intended behavior?

It's basically an inevitability that some patterns will fail. In the
general case, there's no way for the client to know what rules the
server will use to expand the filename that is passed. Throw in quoting
conventions and it's even more of a mess. For this reason, our patch
includes a flag (-T) to disable the client-side checks.

-d