Opened at 2015-10-02T19:35:25Z
Closed at 2015-10-27T20:21:59Z
#2513 closed defect (fixed)
Magic Folder: the localdir argument to the 'tahoe magic-folder {create,join}' commands should be expanded to an absolute path
Reported by: | daira | Owned by: | dawuud |
---|---|---|---|
Priority: | major | Milestone: | undecided |
Component: | code-frontend-magic-folder | Version: | 1.10.1 |
Keywords: | tahoe-magic-folder cli security reliability usability error | Cc: | |
Launchpad Bug: |
Description (last modified by daira)
If you pass a relative path as the local directory to the tahoe magic-folder create or tahoe magic-folder join command, it will be copied into the node's tahoe.cfg entry for [magic_folder]local.directory as-is.
This causes the running node to expand the path relative to its node directory, which is counterintuitive and insecure (since the local directory tree will include the private/ subdirectory).
The create and join commands should expand the path relative to the current directory of the command. It may also be useful to detect cases where there is a node directory underneath a local directory and avoid uploading those files, in case the user does this by accident. (This might cause an infinite regress if the node directory is for a server that is storing shares for the Magic Folder DMD -- and is in any case undesirable.)
Change History (4)
comment:1 Changed at 2015-10-02T20:18:27Z by daira
- Description modified (diff)
comment:2 Changed at 2015-10-14T11:18:12Z by dawuud
comment:3 Changed at 2015-10-16T01:02:04Z by daira
The correct way to expand path arguments is to use encodingutil.argv_to_abspath, which also handles ~, supports "long" paths on Windows, and properly converts to Unicode from the I/O encoding.
comment:4 Changed at 2015-10-27T20:21:59Z by daira
- Resolution set to fixed
- Status changed from new to closed
i teach magic-folder cli to expand relative paths here in my dev branch: https://github.com/david415/tahoe-lafs/tree/2513.expand-relative-path.0
however i did not yet write any tests for this...