Request to revert Windows path restrictions

Hi!

I have been running into some issues with the new changes included to
address CVE-2019-15601. After reading through the original CVE, I'm
not sure that I agree it is an issue with curl, nor do I believe it is
an issue which curl should be responsible for addressing. After
reading through some of the archives on this list, I found the thread:

"Warning: using file:// on Windows with curl"

That thread seemed to pretty well sum up my feelings around the change
implemented with regards to the reported CVE. It doesn't really seem
to be an issue with curl, and if it actually is an issue, it seems to
be more of an issue with Windows itself. Any other tool or application
that loads file paths will have the same behavior as described by the
CVE.

The request to revert the change:

https://github.com/curl/curl/commit/1b71bc532bde8621fd3260843f8197182a467ff2

is due to the fact that this change seems to result in an added
restriction to functionality (breaking functionality which was
previously working) without any significant gain. Network paths can
still be accessed in other ways, and as the documentation now states,
if that type of behavior is unacceptable then the file protocol should
be disabled. But for use cases where the file protocol is desired on
Windows, the restriction on paths with a double slash prefix is
breaking the expected behavior (in this case "expected behavior" being
both handling valid Windows paths and curl's previous behavior until
this changeset). Is reverting the behavior back to its original state
something that would be acceptable?

Thanks so much!

- Chris
-----------------------------------------------------------
Unsubscribe: https://cool.haxx.se/list/listinfo/curl-users
Etiquette: https://curl.haxx.se/mail/etiquette.html
Received on 2020-04-10