Commits on Sep 22, 2023

1. doc: document dangerous symlink behavior …

   Much earlier, a design decision was made that the permission model
   should not prevent following symbolic links to presumably inaccessible
   locations. Recently, after some back and forth, it had been decided that
   it is indeed a vulnerability that symbolic links, which currently point
   to an accessible location, can potentially be re-targeted to point to a
   presumably inaccessible location. Nevertheless, months later, no
   solution has been found and the issue is deemed unfixable in the context
   of the current permission model implementation, so it was decided to
   disclose the vulnerability and to shift responsibiliy onto users who are
   now responsible for ensuring that no potentially dangerous symlinks
   exist in any directories that they grant access to.
   
   I believe that this design issue might be surprising and that it comes
   with significant security implications for users, so it should be
   documented.
   
   Original vulnerability report: https://hackerone.com/reports/1961655

   

   tniessen committed Sep 22, 2023
   Configuration menu

   • View commit details
   • Copy full SHA for 1fd427b
   • Browse repository at this point

   Copy the full SHA

   1fd427b View commit details

   Browse the repository at this point in the history