net-scp 3.0.0 → 4.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0350b7b1df8977a9ae7ac00b5c82a65d26db8fb23296582d21d7f944f04ad26e
-  data.tar.gz: 29e3e812e3c338b67eab704a59dc1365dd5abaeeda08fd5a5ac7419116f4e82e
+  metadata.gz: b666f903f4a48fb442f7ddea7efbdf5a222a44b7e2c9f7ae0cba5b6b8a126e10
+  data.tar.gz: 39032bdfeb545761cd2229af060ca0a79855e051ecab1123e2c68100deb03e19
 SHA512:
-  metadata.gz: 5522c65c85440ca5d95a8a320ed57d635cf2726f9e3d6a02056dd915c753c279368477fd98e2e379e4e5215e164b5c917d32ebcf35aec0734a0816f30ab7ee06
-  data.tar.gz: 8d5ae8236f938551246216f86ec0d059187a971745c614e6362ce1928a878b3450936bfaa6719c77c9bdff4506272ef2623e5844fe5c923b71e8df2bdb166c7a
+  metadata.gz: 8608726350662b31607e5beaa21d0276fa93942b045ac29a5762236b99b5a57925f9fde59a9fb59ebdd6ada2d6ccb1f52aa17f90e7ee196d2c7a714d66afce2d
+  data.tar.gz: 3c4112b0662c5401f6bc4e50aec2797a583faa5d67947ee3e46c2dd7f1d48ed074f49df9893910d08ea09f0625b14071d1d66d8f7390bff66dee60e1e7d19095

data/.github/pull_request_template.md

@@ -0,0 +1 @@
+<!-- After opening the PR, add a changelog.d/<PR number>.<type>.txt fragment (none, change, security, breaking or breaking-security) instead of editing CHANGES.txt; see CONTRIBUTING.md#changelog. -->

data/.github/workflows/changelog.yml

@@ -0,0 +1,18 @@
+name: Changelog
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, labeled, unlabeled]
+
+permissions:
+  contents: read
+
+jobs:
+  changelog:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # HEAD is the PR merged into the base branch; HEAD^1 is the base it was merged into.
+          fetch-depth: 2
+      - uses: net-ssh/changelogd@v1

data/.github/workflows/ci.yml

@@ -0,0 +1,40 @@
+name: CI
+on:
+  pull_request:
+  push: { branches: master }
+permissions:
+  contents: read
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        ruby-version: ['2.6', '2.7', '3.0', '3.1', '3.2', '3.3', '3.4', '4.0', 'ruby-head']
+    continue-on-error: ${{ matrix.ruby-version == 'ruby-head' }}
+    steps:
+      - uses: actions/checkout@v3
+      - name: Set up Ruby ${{ matrix.ruby-version }}
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: ${{ matrix.ruby-version }}
+          bundler-cache: true # runs 'bundle install' and caches installed gems automatically
+      - name: Run Tests
+        run: bundle exec rake test
+        env:
+          RUBYOPT: "--enable=frozen_string_literal"
+  test-legacy:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        ruby-version: ['2.3', '2.4', '2.5']
+    steps:
+      - uses: actions/checkout@v3
+      # Plain docker run rather than container: the ruby:2.3/2.4 images' glibc is too old for the actions' Node.
+      # Not rake test: the Rakefile loads changelogd, which these Rubies can't install.
+      # No frozen_string_literal: net-ssh 6 mutates string literals.
+      - name: Run Tests
+        run: >-
+          docker run --rm -v "$PWD:/w" -w /w -e BUNDLE_GEMFILE=gemfiles/legacy.gemfile ruby:${{ matrix.ruby-version }}
+          sh -c 'bundle install --jobs 4 && bundle exec ruby -Ilib -Itest -e "Dir.glob(\"./test/test_*.rb\").each { |f| require f }"'

data/.gitignore

@@ -4,3 +4,11 @@ doc
 *.swp
 
 .DS_Store
+
+# Bundle local files
+/vendor/
+.bundle/config
+Gemfile.lock
+
+lib/net/ssh/version.rb.old
+/gemfiles/*.lock

data/CHANGES.txt

@@ -1,3 +1,35 @@
+=== 4.1.3
+
+* Load again on Ruby 2.3-2.5 (4.1.2 needed 2.5), and declare `required_ruby_version >= 2.3` [#112, #110]
+* Add a `quote:` option to `upload`/`download` for the remote path: `:posix` (default), `:windows` for Win32-OpenSSH under cmd.exe or PowerShell (double-quoted, `\` sent as `/`, paths containing `"`, `$`, `` ` ``, `%`, `!`, curly quotes, CR, LF or NUL rejected), `:none` to send the path unchanged to servers without a shell, or a callable. By default a leading `~` or `~/` is now left for the remote shell to expand to the home directory; such paths previously referred to a literal `~` entry in the login directory and usually failed. Thanks @ArtsiomMusin for the Windows patch in #34 [#109, #34, #9]
+* Recursive uploads no longer abort on a broken symlink: it is skipped with a warning, the rest is uploaded, and a Net::SCP::Error listing the skipped paths is raised at the end, like OpenSSH scp. Based on #23 by @maage. [#108, #23]
+
+=== 4.1.2
+
+* Security: Downloads no longer apply setuid, setgid or sticky bits sent by the server, check that a server-chosen local name matches the requested remote basename (as OpenSSH does since CVE-2019-6111), and refuse to follow an existing local symlink at a server-named path instead of writing through it. The local path passed by the caller may still be a symlink. O_NOFOLLOW suggested in net-sftp#162 by srosenhamer [#104]
+* Security: Recursive downloads, and downloads into a directory, reject file names from the server that are not a single path component (such as `../x` or `a/b`) instead of writing outside the target directory. Reported in net-sftp#162 by srosenhamer [#103]
+* Raise `Net::SCP::Error` when the server ends a transfer before the SCP protocol finishes, instead of reporting a truncated transfer as successful [#105, #96]
+* Opening an `scp://` URI through `uri/open-scp` now percent-decodes the user, password and path (once, keeping a literal `+`) and passes an IPv6 address to SSH without its brackets, so `scp://user@[::1]/a%20b` downloads `/a b` from `::1`. Thanks @OskarEichler [#94]
+* Opening an `scp://` URI through `uri/open-scp` now writes the download into the OpenURI buffer as it arrives, so large files spill to a temporary file instead of being held in memory twice. Thanks @OskarEichler [#93]
+* Parsing an `scp://` URI with a valueless query entry (`?flag`) or an empty one (`?a=1&&b=2`) no longer raises `NoMethodError`, and `URI::SCP#options` reflects the current query after `query=`. Thanks @OskarEichler [#92]
+* Opening an `scp://` URI through `uri/open-scp` now calls `:progress_proc` with the number of bytes received, as OpenURI documents, instead of with the SCP progress arguments (which raised `ArgumentError` for a lambda), and calls `:content_length_proc` once with the file size. Thanks @OskarEichler [#91]
+* Opening an `scp://` URI through `uri/open-scp` now uses the port and password given in the URI; they were passed outside the `:ssh` options and ignored. Options given in `:ssh` still take precedence. Thanks @OskarEichler [#90]
+* Close the local file net-scp opened for an upload or download when the transfer fails, so it is not left open (and locked on Windows) [#89, #20]
+* With `preserve: true`, recursive downloads now keep directories' modification times, which were overwritten when their contents were created. Thanks @OskarEichler [#88]
+* `upload`/`upload!` with a zero, negative or non-Integer `:chunk_size` now raises `ArgumentError` before opening a channel; previously `0` hung forever sending empty chunks, a negative value or a String failed only after the channel was open, and a Float was silently truncated. Thanks @OskarEichler [#87]
+* Uploading from an IO that isn't at its start now announces only the remaining bytes, instead of the full size, which made the transfer hang or fail. Thanks @OskarEichler [#86]
+* Accept a `Pathname` as the local path for uploads and downloads; previously uploads looped forever and downloads kept only the last chunk. Thanks @OskarEichler [#85, #29]
+
+=== 4.1.1
+
+* Allow net-ssh 8
+* Fix frozen string literal compatibility [npezza93, mfazekas]
+  - Use mutable string for scp command construction
+  - Use mutable string for error_string initialization
+* Add Ruby 3.4 and ruby-head to CI matrix
+* Add Ruby 4.0+ compatibility (logger, rdoc gems)
+* Drop EOL Ruby 2.3-2.5 from CI
+
 === 3.0.0
 
 * NetSHH 6.* support

data/CONTRIBUTING.md

@@ -0,0 +1,33 @@
+# Contributing to net-scp
+
+Run the tests with `bundle exec rake test`.
+
+## Changelog
+
+Don't edit `CHANGES.txt`. Instead, add a fragment file to `changelog.d/` in your PR; the release's version bump (`rake vbump:*`) moves all fragments into a new `=== <version>` section at the top of `CHANGES.txt` and deletes them.
+
+A fragment is named `<number>.<type>.txt`, where `<number>` is the PR number (so open the PR first, then add the fragment), and contains a single UTF-8 paragraph: the entry as it should read in `CHANGES.txt`, without the bullet or prefix. Lines are joined, so it can be wrapped. If it doesn't end with a reference list such as `[#95, #101]` or `[GHSA-xxxx-xxxx-xxxx]`, ` [#<number>]` is appended.
+
+| Type                | Written as                     | Use for                                                      |
+| ------------------- | ------------------------------ | ------------------------------------------------------------ |
+| `breaking-security` | `* BREAKING: Security: <text>` | an incompatible change made for security                     |
+| `breaking`          | `* BREAKING: <text>`           | an incompatible change                                       |
+| `security`          | `* Security: <text>`           | a security fix or hardening                                  |
+| `change`            | `* <text>`                     | any other user-visible fix or feature                        |
+| `none`              | nothing                        | PRs with no user-visible change (tests, CI, docs, refactors) |
+
+Examples:
+
+```sh
+rake "changelog:new[102,change,Fixed uploading files with spaces in their names]"
+# changelog.d/102.change.txt -> * Fixed uploading files with spaces in their names [#102]
+
+echo 'Refuse downloads that write outside the target directory [GHSA-xxxx-xxxx-xxxx]' > changelog.d/103.security.txt
+touch changelog.d/104.none.txt
+```
+
+For several entries from one PR add a suffix: `102.change.txt`, `102.change.2.txt` (`changelog:new` picks the next free one).
+
+`rake changelog:check` validates the fragments and `rake changelog:preview` prints the section the next release would add. CI fails a PR that edits `CHANGES.txt` or doesn't add or modify a `changelog.d/<PR number>.<type>.txt` fragment, unless it only touches `changelog.d/` or a maintainer adds the `skip-changelog` label; Dependabot PRs are skipped.
+
+The full rules, including how a release orders the entries, are in the [changelogd README](https://github.com/net-ssh/changelogd#readme).

data/Gemfile

@@ -3,9 +3,16 @@ source 'https://rubygems.org'
 # Specify your gem's dependencies in mygem.gemspec
 gemspec
 
+gem "net-ssh", ">= 7.3.1"
+gem "logger" # no longer a default gem in Ruby 4.0+
+
 # TODO: add to gemspec
-gem "bundler", "~> 1.11"
-gem "rake", "~> 12.0"
+gem "bundler", ">= 1.11"
+gem "rake", ">= 12.0"
+gem "rdoc"
+
+# git: rather than github:, which Bundler 1.x (the publish workflow uses 1.17.3) expands to an unsupported git:// URL.
+gem "changelogd", git: "https://github.com/net-ssh/changelogd.git", tag: "v1", group: :development
 
 gem 'byebug', group: %i[development test] if !Gem.win_platform? && RUBY_ENGINE == "ruby"
 

data/Manifest

@@ -7,7 +7,7 @@ lib/net/scp.rb
 lib/uri/open-scp.rb
 lib/uri/scp.rb
 Rakefile
-README.rdoc
+README.md
 setup.rb
 test/common.rb
 test/test_all.rb

data/README.md

@@ -0,0 +1,161 @@
+# Net::SCP
+
+***Please note: this project is in maintenance mode. It is not under active
+development but pull requests are very much welcome. Just be sure to include
+tests! -- delano***
+
+*   Docs: http://net-ssh.github.io/net-scp
+*   Issues: https://github.com/net-ssh/net-scp/issues
+*   Codes: https://github.com/net-ssh/net-scp
+*   Email: net-ssh@solutious.com
+
+
+*As of v1.0.5, all gem releases are signed. See INSTALL.*
+
+## DESCRIPTION:
+
+Net::SCP is a pure-Ruby implementation of the SCP protocol. This operates over
+SSH (and requires the Net::SSH library), and allows files and directory trees
+to be copied to and from a remote server.
+
+## FEATURES/PROBLEMS:
+
+*   Transfer files or entire directory trees to or from a remote host via SCP
+*   Can preserve file attributes across transfers
+*   Can download files in-memory, or direct-to-disk
+*   Support for SCP URI's, and OpenURI
+
+
+## SYNOPSIS:
+
+In a nutshell:
+
+```ruby
+require 'net/scp'
+
+# upload a file to a remote server
+Net::SCP.upload!("remote.host.com", "username",
+  "/local/path", "/remote/path",
+  :ssh => { :password => "password" })
+
+# upload recursively
+Net::SCP.upload!("remote.host", "username", "/path/to/local", "/path/to/remote",
+   :ssh => { :password => "foo" }, :recursive => true)
+
+# download a file from a remote server
+Net::SCP.download!("remote.host.com", "username",
+  "/remote/path", "/local/path",
+  :ssh => { :password => "password" })
+
+# download a file to an in-memory buffer
+data = Net::SCP::download!("remote.host.com", "username", "/remote/path")
+
+# use a persistent connection to transfer files
+Net::SCP.start("remote.host.com", "username", :password => "password") do |scp|
+  # upload a file to a remote server
+  scp.upload! "/local/path", "/remote/path"
+
+  # upload from an in-memory buffer
+  scp.upload! StringIO.new("some data to upload"), "/remote/path"
+
+  # run multiple downloads in parallel
+  d1 = scp.download("/remote/path", "/local/path")
+  d2 = scp.download("/remote/path2", "/local/path2")
+  [d1, d2].each { |d| d.wait }
+end
+
+# You can also use open-uri to grab data via scp:
+require 'uri/open-scp'
+data = open("scp://user@host/path/to/file.txt").read
+```
+
+The remote path is escaped for a POSIX shell, except that a leading `~` or
+`~/` is left for the remote shell to expand to the home directory (`~user/` is
+not expanded). Use the `quote:` option of `upload`/`download` for other
+servers:
+
+```ruby
+# Win32-OpenSSH (cmd.exe or PowerShell): the path is double-quoted and "\" becomes "/".
+# Paths containing ", $, `, %, !, curly quotes, CR, LF or NUL raise ArgumentError.
+scp.upload! "/local/path", "C:\\Program Files\\App\\file.txt", quote: :windows
+
+# Servers that don't run a shell (MikroTik and other appliances): the path is
+# sent unchanged. Never use this with untrusted paths.
+scp.download! "flash/backup.rsc", "/local/backup.rsc", quote: :none
+
+# Or quote it yourself
+scp.upload! "/local/path", remote, quote: ->(path) { "'#{path}'" }
+```
+
+For more information, see Net::SCP.
+
+## REQUIREMENTS:
+
+*   Net::SSH 2
+
+If you wish to run the tests, you'll also need:
+
+*   Echoe (for Rakefile use)
+*   Mocha (for tests)
+
+
+## INSTALL:
+
+*   ```gem install net-scp (might need sudo privileges)```
+
+
+However, in order to be sure the code you're installing hasn't been tampered
+with, it's recommended that you verify the
+[signature](http://docs.seattlerb.org/rubygems/Gem/Security.html). To do this,
+you need to add my public key as a trusted certificate (you only need to do
+this once):
+
+```sh
+# Add the public key as a trusted certificate
+# (You only need to do this once)
+$ curl -O https://raw.githubusercontent.com/net-ssh/net-ssh/master/net-ssh-public_cert.pem
+$ gem cert --add net-ssh-public_cert.pem
+```
+
+Then- when installing the gem - do so with high security:
+
+    $ gem install net-scp -P HighSecurity
+
+If you don't add the public key, you'll see an error like "Couldn't verify
+data signature". If you're still having trouble let me know and I'll give you
+a hand.
+
+Or, you can do it the hard way (without Rubygems):
+
+*   tar xzf net-scp-*.tgz
+*   cd net-scp-*
+*   ruby setup.rb config
+*   ruby setup.rb install (might need sudo privileges)
+
+## Security contact information
+
+See [SECURITY.md](SECURITY.md)
+
+## LICENSE:
+
+(The MIT License)
+
+Copyright (c) 2008 Jamis Buck <jamis@37signals.com>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the 'Software'), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/Rakefile

@@ -1,7 +1,10 @@
 require "rubygems"
 require "rake"
 require "rake/clean"
-require "rdoc/task"
+begin
+  require "rdoc/task"
+rescue LoadError
+end
 require "bundler/gem_tasks"
 
 desc "When releasing make sure NET_SSH_BUILDGEM_SIGNED is set"
@@ -19,6 +22,16 @@ name = "net-scp"
 require_relative "lib/net/scp/version"
 version = Net::SCP::Version::CURRENT
 
+begin
+  require "changelogd/rake"
+rescue LoadError
+  # A git gem isn't on the load path under plain `rake`, as the release workflow runs it; bundler/setup could clash with the running rake.
+  require "bundler"
+  $LOAD_PATH.unshift(*Bundler.definition.specs["changelogd"].flat_map(&:full_require_paths))
+  require "changelogd/rake"
+end
+Changelogd::RakeTasks.new(version_file: "lib/net/scp/version.rb")
+
 namespace :cert do
   desc "Update public cert from private - only run if public is expired"
   task :update_public_when_expired do
@@ -67,15 +80,106 @@ Rake::TestTask.new do |t|
 end
 
 extra_files = %w[LICENSE.txt THANKS.txt CHANGES.txt ]
-RDoc::Task.new do |rdoc|
-  rdoc.rdoc_dir = "rdoc"
-  rdoc.title = "#{name} #{version}"
-  rdoc.generator = 'hanna' # gem install hanna-nouveau
-  rdoc.main = 'README.rdoc'
-  rdoc.rdoc_files.include("README*")
-  rdoc.rdoc_files.include("bin/*.rb")
-  rdoc.rdoc_files.include("lib/**/*.rb")
-  extra_files.each { |file|
-    rdoc.rdoc_files.include(file) if File.exists?(file)
-  }
+if defined?(RDoc::Task)
+  RDoc::Task.new do |rdoc|
+    rdoc.rdoc_dir = "rdoc"
+    rdoc.title = "#{name} #{version}"
+    rdoc.generator = 'hanna' # gem install hanna-nouveau
+    rdoc.main = 'README.md'
+    rdoc.rdoc_files.include("README*")
+    rdoc.rdoc_files.include("bin/*.rb")
+    rdoc.rdoc_files.include("lib/**/*.rb")
+    extra_files.each { |file|
+      rdoc.rdoc_files.include(file) if File.exist?(file)
+    }
+  end
+end
+
+def change_version(&block)
+  Rake::Task["changelog:check"].invoke
+  version_file = 'lib/net/scp/version.rb'
+  require_relative version_file
+  pre = Net::SCP::Version::PRE
+  tiny = Net::SCP::Version::TINY
+  result = block[pre: pre, tiny: Net::SCP::Version::TINY]
+  raise ArgumentError, "Version change logic should always return a pre" unless result.key?(:pre)
+
+  new_pre = result[:pre]
+  new_tiny = result[:tiny] || tiny
+  found = { pre: false, tiny: false }
+  File.open("#{version_file}.new", "w") do |f|
+    File.readlines(version_file).each do |line|
+      match =
+        if pre.nil?
+          /^(\s+PRE\s+=\s+)nil(\s*)$/.match(line)
+        else
+          /^(\s+PRE\s+=\s+")#{pre}("\s*)$/.match(line)
+        end
+      if match
+        prefix = match[1]
+        postfix = match[2]
+        prefix.delete_suffix!('"')
+        postfix.delete_prefix!('"')
+        new_line = "#{prefix}#{new_pre.inspect}#{postfix}"
+        puts "Changing:\n  - #{line}  + #{new_line}"
+        line = new_line
+        found[:pre] = true
+      end
+
+      if new_tiny != tiny
+        match = /^(\s+TINY\s+=\s+)#{tiny}(\s*)$/.match(line)
+        if match
+          prefix = match[1]
+          postfix = match[2]
+          new_line = "#{prefix}#{new_tiny}#{postfix}"
+          puts "Changing:\n  - #{line}  + #{new_line}"
+          line = new_line
+          found[:tiny] = true
+        end
+      end
+
+      f.write(line)
+    end
+    raise ArgumentError, "Cound not find line: PRE = \"#{pre}\" in #{version_file}" unless found[:pre]
+    raise ArgumentError, "Cound not find line: TINY = \"#{tiny}\" in #{version_file}" unless found[:tiny] || new_tiny == tiny
+  end
+
+  FileUtils.mv version_file, "#{version_file}.old"
+  FileUtils.mv "#{version_file}.new", version_file
+  Rake::Task["changelog:release"].invoke
+end
+
+namespace :vbump do
+  desc "Final release"
+  task :final do
+    change_version do |pre:, tiny:|
+      _ = tiny
+      if pre.nil?
+        { tiny: tiny + 1, pre: nil }
+      else
+        raise ArgumentError, "Unexpected pre: #{pre}" if pre.nil?
+
+        { pre: nil }
+      end
+    end
+  end
+
+  desc "Increment prerelease"
+  task :pre, [:type] do |_t, args|
+    change_version do |pre:, tiny:|
+      puts " PRE => #{pre.inspect}"
+      match = /^([a-z]+)(\d+)/.match(pre)
+      raise ArgumentError, "Unexpected pre: #{pre}" if match.nil? && args[:type].nil?
+
+      if match.nil? || (!args[:type].nil? && args[:type] != match[1])
+        if pre.nil?
+          { pre: "#{args[:type]}1", tiny: tiny + 1 }
+        else
+          { pre: "#{args[:type]}1" }
+        end
+      else
+        { pre: "#{match[1]}#{match[2].to_i + 1}" }
+      end
+    end
+  end
 end

data/SECURITY.md

@@ -0,0 +1,4 @@
+## Security contact information
+
+To report a security vulnerability, please use the
+[GitHub vulnerability reporting feature](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability).

data/changelog.d/README.md

@@ -0,0 +1 @@
+Changelog fragments: one `<PR number>.<type>.txt` file per user-visible change, assembled into `CHANGES.txt` when the version is bumped. See [CONTRIBUTING.md](../CONTRIBUTING.md#changelog).

data/gemfiles/legacy.gemfile

@@ -0,0 +1,7 @@
+# Ruby 2.3-2.5: the last net-ssh and mocha releases that still install there.
+source 'https://rubygems.org'
+
+gemspec path: ".."
+
+gem "net-ssh", "< 7"
+gem "mocha", "< 2"

data/lib/net/scp/download.rb

@@ -50,8 +50,11 @@ module Net; class SCP
       when :file
         read_file(channel, directive)
       when :end
+        directory = channel[:stack].pop
+        if channel[:options][:preserve] && directory && directory[:times]
+          File.utime(directory[:times][:atime], directory[:times][:mtime], channel[:local])
+        end
         channel[:local] = File.dirname(channel[:local])
-        channel[:stack].pop
         channel[:state] = :finish if channel[:stack].empty?
       end
 
@@ -73,7 +76,7 @@ module Net; class SCP
     # Finishes off the read, sets the times for the file (if any), and then
     # jumps to either #finish_state (for single-file downloads) or
     # #read_directive_state (for recursive downloads). A 0-byte is sent to the
-    # server to indicate that the file was recieved successfully.
+    # server to indicate that the file was received successfully.
     def finish_read_state(channel)
       channel[:io].close unless channel[:io] == channel[:local]
 
@@ -126,19 +129,17 @@ module Net; class SCP
         raise Net::SCP::Error, ":recursive not specified for directory download"
       end
 
-      channel[:local] = File.join(channel[:local], directive[:name])
+      channel[:local] = local_path_for(channel, directive[:name])
 
-      if File.exist?(channel[:local]) && !File.directory?(channel[:local])
+      if File.symlink?(channel[:local])
+        raise Net::SCP::Error, "#{channel[:local]} is a symlink, refusing to follow it"
+      elsif File.exist?(channel[:local]) && !File.directory?(channel[:local])
         raise Net::SCP::Error, "#{channel[:local]} already exists and is not a directory"
       elsif !File.exist?(channel[:local])
-        Dir.mkdir(channel[:local], directive[:mode] | 0700)
+        Dir.mkdir(channel[:local], (directive[:mode] & 0777) | 0700)
       end
 
-      if channel[:options][:preserve] && channel[:times]
-        File.utime(channel[:times][:atime], channel[:times][:mtime], channel[:local])
-      end
-
-      channel[:stack] << directive
+      channel[:stack] << directive.merge(:times => channel[:times])
       channel[:times] = nil
     end
 
@@ -146,20 +147,54 @@ module Net; class SCP
     # actual read.
     def read_file(channel, directive)
       if !channel[:local].respond_to?(:write)
-        directive[:name] = (channel[:options][:recursive] || File.directory?(channel[:local])) ?
-          File.join(channel[:local], directive[:name]) :
-          channel[:local]
+        server_named = channel[:options][:recursive] || File.directory?(channel[:local])
+        directive[:name] = server_named ? local_path_for(channel, directive[:name]) : channel[:local]
       end
 
       channel[:file] = directive.merge(:times => channel[:times])
+      # Setuid/setgid/sticky bits are never taken from the server, even with :preserve.
       channel[:io] = channel[:local].respond_to?(:write) ? channel[:local] :
-        File.new(directive[:name], "wb", directive[:mode] | 0600)
+        open_local_file(directive[:name], (directive[:mode] & 0777) | 0600, server_named)
       channel[:times] = nil
       channel[:remaining] = channel[:file][:size]
       channel[:state] = :read_data
 
       progress_callback(channel, channel[:file][:name], 0, channel[:file][:size])
     end
+
+    # The name comes from the server, so anything but a single path component
+    # would let a malicious server write outside the target (CVE-2019-6111).
+    def local_path_for(channel, name)
+      if name.empty? || name == "." || name == ".." || name.include?("/") || name.include?("\0") ||
+         (File::ALT_SEPARATOR && name.include?(File::ALT_SEPARATOR))
+        raise Net::SCP::Error, "invalid file name from server: #{name.inspect}"
+      end
+
+      if channel[:stack].empty? && !requested_name?(channel[:remote], name)
+        raise Net::SCP::Error, "file name from server does not match request: #{name.inspect}"
+      end
+
+      File.join(channel[:local], name)
+    end
+
+    # OpenSSH's CVE-2019-6111 check: the flags mirror its brace expansion plus fnmatch(3) with flags 0.
+    def requested_name?(remote, name)
+      pattern = File.basename(remote.to_s)
+      name == pattern || File.fnmatch(pattern, name, File::FNM_DOTMATCH | File::FNM_EXTGLOB)
+    end
+
+    # A symlink planted at a server-named path must not redirect the write;
+    # the caller's own target may be a symlink on purpose (net-sftp#162).
+    def open_local_file(path, perm, nofollow)
+      return File.new(path, "wb", perm) unless nofollow && defined?(File::NOFOLLOW)
+
+      begin
+        File.new(path, "wb", perm, :flags => File::NOFOLLOW)
+      rescue SystemCallError
+        raise unless File.symlink?(path)
+        raise Net::SCP::Error, "#{path} is a symlink, refusing to follow it"
+      end
+    end
   end
 
 end; end