dave2wave commented on code in PR #1592:
URL:
https://github.com/apache/tooling-trusted-releases/pull/1592#discussion_r3991192742
##########
atr/ssh.py:
##########
@@ -290,11 +290,12 @@ async def server_stop(server: asyncssh.SSHAcceptor) ->
None:
log.info("SSH server stopped")
-def _build_rsync_write_argv(argv: list[str], path: safe.StatePath) ->
list[str]:
+def _build_rsync_write_argv(argv: list[str]) -> list[str]:
"""Build the rsync command for a write, adding enforced server side
limits."""
if len(argv) < 2 or argv[-2] != ".":
raise RuntimeError("Validated rsync write argv must end with '.' and
the destination path")
- return [*argv[:-2], f"--max-size={_RSYNC_MAX_UPLOAD_SIZE}",
"--info=skip2", ".", str(path)]
+ # Use exactly '.' so rsync does not reopen ancestors outside the Landlock
sandbox
Review Comment:
It looks like an LLM told you this was a path traversal issue, we've seen
that numerous times. And this was likely how we want it to work. @sbp ?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
