openssh bugs - Jan 2024 - [Bug 3660] New: Prevent disastrous unintended local copying

https://bugzilla.mindrot.org/show_bug.cgi?id=3660

            Bug ID: 3660
           Summary: Prevent disastrous unintended local copying
           Product: Portable OpenSSH
           Version: 9.6p1
          Hardware: Other
                OS: Linux
            Status: NEW
          Severity: enhancement
          Priority: P5
         Component: scp
          Assignee: unassigned-bugs at mindrot.org
          Reporter: jidanni at jidanni.org

$ scp a b c:
but if our hand slips and we only do
$ scp a b
we clobber b.

Instead it should say
"To copy locally, please use cp(1)" (which one can alias to cp -i
too!)

Or it could say "are you sure?" etc.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3660

Jim Knoble <jmknoble at pobox.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jmknoble at pobox.com

--- Comment #1 from Jim Knoble <jmknoble at pobox.com> ---
In your $HOME/.profile or $HOME/.bashrc add the following function:

scp() {
    case "$*" in
        *:*|*-h|'')
            command scp ${1:+"$@"}
            ;;
        *)
            echo "scp: error: Use cp(1) to copy files locally"
>&2
            return 1
            ;;
    esac
}

(Warning: untested).

That should put a safety on your footgun without modifying the scp
binary, *and* it will work on just about any version of scp.

If you need a fancier footgun safety, consider a Python script that
wraps the scp command and appears earlier on $PATH.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3660

--- Comment #2 from Dan Jacobson <jidanni at jidanni.org> ---
Never mind about me.
I'm saying for the general public.
Let's go back to the scp man page.

Right at the top it says
>        scp copies files between hosts on a network.
That would seem to exclude the same machine.

$ scp xx xx
cp: 'xx' and 'xx' are the same file

Good. At least it won't copy to the same file.

$ scp xx xy
$

OK, as a bonus it copys to the same machine.

But is should still wonder, why would the user want to copy to the same
machine?

He could have used just cp, one letter shorter than scp.

There is a 99% change the user didn't intend to copy to the same
machine,
and some disaster is about to happen.

Therefore, scp should be more responsible, and ask the user if he is
sure, at least.

No, users shouldn't be required to make fancy workarounds to prevent
the danger that is all due to questionable design.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3660

--- Comment #3 from Dan Jacobson <jidanni at jidanni.org>
---
> But is should still wonder, why would the user want to copy to the same
machine?
< But it should still wonder, why would the user want to copy to the
same machine?

-- 
You are receiving this mail because:
You are watching the assignee of the bug.