openssh bugs - Jan 2010 - [Bug 1703] New: Chunked file uploads

https://bugzilla.mindrot.org/show_bug.cgi?id=1703

           Summary: Chunked file uploads
           Product: Portable OpenSSH
           Version: 5.3p1
          Platform: Other
        OS/Version: Linux
            Status: NEW
          Severity: normal
          Priority: P2
         Component: sftp
        AssignedTo: unassigned-bugs at mindrot.org
        ReportedBy: juangiordana at gmail.com


Hello,

When I upload PHP files to a server it seems that the files are copied
over to the remote location instead of being transferred to a temporary
location (or buffered) and then moved to the appropriate place. I don't
know how is this supposed to work though, but if these files are being
uploaded to the remote location in chunks then this is probably a cause
of trouble, at least for me.

The thing is that when I upload some files with a relative big size
(~40 KB), I can see some PHP parse errors later on the web server logs
(i.e. PHP parse errors triggered by 'unexpected end of file').

Because of the nature of scripting languages and because of the nature
of PHP being able to be embedded within HTML code my main concern is
that this problem could also lead to code leaks, since if the file
isn't fully transferred, some PHP open/close tag would be missed and
that way the code being leaked to the user's browser/bot.

Regards.

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=1703

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |djm at mindrot.org
            Summary|Chunked file uploads        |Atomic replace on upload
           Severity|normal                      |enhancement

--- Comment #1 from Damien Miller <djm at mindrot.org> 2010-03-26 11:40:05
EST ---
It would be fairly easy to support atomic replacement of files on
upload in the OpenSSH sftp client. However, it wouldn't work for scp or
other sftp clients.

Basically, the client would get an option (-a perhaps) to get/put that
up/downloaded into a temporary file and then renamed it into place. For
sftp, we would need to enable this only for servers that supported the
POSIX rename extension,

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.