News for hackers. Stuff that matters.

A comment on Rsync client-side arbitrary file write vulnerability. Parent comment

Re:Rsync client-side arbitrary file write vulnerability by neoneye2 on Tuesday August 02, 2022 @12:30PM (#32320835)
What if the input contains multiple `/./` ? It seems that `cp = strstr(arg, "/./");` only checks once. Maybe wrap in a loop?
[ Parent | on HN ]
Re:Rsync client-side arbitrary file write vulnerability by account42 on Wednesday August 03, 2022 @09:24AM (#32331369)
No, this is for handling the --relative (-R) flag where the part after the first /./ in each source path is a relative destination for that path so e.g.

  rsync -aR foo/./bar/baz/ dest/
copies data from foo/bar/baz/ to dest/bar/baz/ while any other /./ is effectively meaningless.
[ Parent | on HN ]