Windows: User can escape from root directory

[yetanothernickname]

Windows, default File System, root directory set in login event callback. User can browse parent directory using /../../ in URL.
Example:
root: 'X:\\Project\\Storage\\User'

URL ftp://127.0.0.1/../../ becomes a command CWD \/../../

At line 30 in fs.js we have nodePath.resolve('X:\Project\Storage\User', '.\\\..\..\')

So _resolvePath() returns

{
  clientPath: '\\..\..\',
  fsPath: 'X:\Project'
}

[trs]

This must be a bug on windows. I’ll have to investigate.

There is a specific test to ensure users cannot escape the root directory: https://github.com/trs/ftp-srv/blob/master/test/fs.spec.js#L65

The clientPath is passed through normalize which would resolve any . and ...
For example, in the test case, attempting to change directory to ../../../../../../../../../../.. would result in a clientPath (the path the client is actually shown) as /. Whereas the fsPath (the actual path on the server) would resolve to the root.

[yetanothernickname]

Notice the backslash in the CWD command. I can't explain it, but..

const path = require('path');
console.log(path.normalize('\\/../../../../'));

Linux:
../../../

Windows:
\\..\..\

[trs]

Trying this on windows I can't recreate it using Filezilla, Firefox, or Edge. What client are you using?

But in the next PR I have removed the added separator when joining paths, this should solve your issue.

[yetanothernickname]

Firefox. Demo
I have a suspicion that this module is not designed to work with URLs...

[trs]

Thanks for the demo video. The attached PR (#168) should address this issue. I'll work on getting it released soon.

[yetanothernickname]

You can see how #168 works in this video :)

[trs]

@yetanothernickname You used #168 for that video?

[yetanothernickname]

@trs Yes, with new fsPath()

[matt-forster]

I'd like to see if we can confirm this is still the case with the changes we made because it shouldn't be.

[n-timofeev]

@forstermatth I was able to reproduce it on 4cd88b1

[matt-forster]

@n-timofeev Thanks, I will take a look this week.