veeso / suppaftp / 32158179543

81%

push

github

fix: reject FTP commands carrying CR or LF to prevent command injection (#172)

* fix: reject FTP commands carrying CR or LF to prevent command injection

An argument containing CR or LF ended the intended command line and let a
second command be smuggled onto the control channel. Every rendered command
is now validated before it is written to the wire, in the sync, tokio and
smol implementations alike, and rejected with an InvalidInput connection
error.

As a consequence custom_command no longer accepts several commands joined by
CRLF in a single call.

Refs: #171

* chore: release 10.0.2

172 of 181 new or added lines in 4 files covered. (95.03%)

5298 of 6566 relevant lines covered (80.69%)

146.99 hits per line