28107451696

Committed 24 Jun 2026 02:51PM UTC coverage: 92.468% (-0.6%) from 93.032%

Build # 28107451696

Build Type

push

github

Committed by

web-flow

Commit Message

If the undocumented `UserDirRoot` directive is used for anonymous logins, _and_ `UserAlias` is unwisely used with a wildcard matching, the constructed `chroot(2)` path for the login could be surprisingly different than expected.

Sanitize the client-provided `USER` name in such situations, to ensure that the constructed path is under the configured `<Anonymous>` chroot path.

Thanks to Fabian Wahle of Hap Security for reporting this issue.

Coverage Stats

48692 of 52658 relevant lines covered (92.47%)

241.3 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

50.0

/usr/include/stdlib.h

Source Not Available

The file "/usr/include/stdlib.h" isn't available on github. Either it's been removed, or the repo root directory needs to be updated.

proftpd / proftpd / 28107451696

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source Not Available

Source File
Press 'n' to go to next uncovered line, 'b' for previous