Subject: Re: NNCP path traversal attack.

From: Eugene Medvedev <[email-masked]>
Date: Fri, 19 Sep 2025 09:43:58 +0300

On Fri, 19 Sept 2025 at 09:29, Jonathan Lane <[email-masked]> wrote:

> The usual protection against symlink traversal is running services in a
> chroot jail, Docker, or some other imposed filesystem boundary.  I'm not
> sure there's a good source-level fix for this that runs everywhere NNCP
> does.

I'm not sure symlink traversal is a problem per se: You can't introduce a
symlink with nncp-file, while whatever symlinks exist are presumably where
the owner of the node wanted them.

Plain path traversal, where you have a freq in "/fileshare/whatever" and
then an incoming packet requests "../../etc/nncp.hjson" and gets it,
definitely is a problem that can be patched away, and hopefully my
patch is sufficient. I don't think Docker or chroot jails can cover that,
because every time you toss you have to read nncp.json...

-- 
Eugene Medvedev