Files
Rob Hague c66b9f8fb0 Require an explicit IRemotePathTransformation for ScpClient
SCP performs a transfer by running scp on the server with the remote path
embedded in a command. On a shell-based server that command is interpreted
by a shell, so a path that is not quoted to suit that shell can be executed
as a command on the server (GHSA-mggc-4xg6-vcxf); on a non-shell-based
server the path is used literally and must not be quoted at all. The right
encoding therefore depends on the server, and no single transformation is
safe for every server.

Rather than default this choice, obsolete the ScpClient constructors that
implicitly used DoubleQuote and add constructors that take an
IRemotePathTransformation explicitly, so callers must choose one suited to
their server and trust environment. DoubleQuote remains the default for the
obsolete constructors, so existing behaviour is unchanged. Document the
consideration on ScpClient and IRemotePathTransformation, and recommend
using SFTP.
2026-08-09 18:31:07 +02:00

44 lines
1.3 KiB
C#

#pragma warning disable CS0618 // These SCP tests use the obsolete default-transformation constructors.
namespace Renci.SshNet.IntegrationTests
{
/// <summary>
/// The SCP client integration tests
/// </summary>
[TestClass]
public class ScpClientTests : IntegrationTestBase, IDisposable
{
private readonly ScpClient _scpClient;
public ScpClientTests()
{
_scpClient = new ScpClient(SshServerHostName, SshServerPort, User.UserName, User.Password);
_scpClient.Connect();
}
[TestMethod]
public void Upload_And_Download_FileStream()
{
var file = $"/tmp/{Guid.NewGuid()}.txt";
var fileContent = "File content !@#$%^&*()_+{}:,./<>[];'\\|";
using var uploadStream = new MemoryStream(Encoding.UTF8.GetBytes(fileContent));
_scpClient.Upload(uploadStream, file);
using var downloadStream = new MemoryStream();
_scpClient.Download(file, downloadStream);
var result = Encoding.UTF8.GetString(downloadStream.ToArray());
Assert.AreEqual(fileContent, result);
}
public void Dispose()
{
_scpClient.Disconnect();
_scpClient.Dispose();
}
}
}