Nadav0077 600be0de54 Reject unsafe server-supplied names in SCP recursive download ...

A malicious or compromised SCP server could return file or directory names containing
path separators, drive qualifiers, or parent-directory references.
ScpClient.Download(string, DirectoryInfo) combined these into a local path without
validation, allowing writes outside the destination directory. Server-supplied C and D
record names are now validated before being combined into a local path.

Signed-off-by: Nadav0077 <18245584+Nadav0077@users.noreply.github.com>

2026-08-09 18:32:00 +02:00

..

Data

Drop DSA (#1558)

2025-01-03 11:12:21 +01:00

Renci.SshNet.AotCompatibilityTestApp

Add .NET 10 target and make use of C#14 extension members (#1672)

2025-11-15 12:21:49 +01:00

Renci.SshNet.Benchmarks

Encrypt packets in-place (#1787)

2026-05-05 12:57:13 +02:00

Renci.SshNet.IntegrationBenchmarks

Require an explicit IRemotePathTransformation for ScpClient

2026-08-09 18:31:07 +02:00

Renci.SshNet.IntegrationTests

Reject unsafe server-supplied names in SCP recursive download

2026-08-09 18:32:00 +02:00

Renci.SshNet.Tests

Reject unsafe server-supplied names in SCP recursive download

2026-08-09 18:32:00 +02:00

Renci.SshNet.TestTools.OpenSSH

Fixes spelling errors (#1668)

2025-07-12 21:01:57 +02:00

.editorconfig

Update to MSTest 4 (#1721)

2025-11-14 22:09:13 +01:00

Directory.Build.props

Fix some (lots of) issues reported by analyzers. (#1125)

2023-05-24 20:37:46 +02:00