Martin Prikryl 3b3f024794 Issue 2477 – Recursive SCP directory download allows local path traversal when replacing of invalid characters in filenames is disabled ...

https://winscp.net/tracker/2477
(cherry picked from commit f998f3e79f)

Source commit: e3039dfefb13303c6fb00db56f71c9fbb6685ef9

2026-10-24 00:44:55 +02:00

..

Bookmarks.cpp

Refactoring old-style casts

2025-12-18 01:20:33 +01:00

Bookmarks.h

Clang imposed changes that should be noop and have no effect on classic compiler

2025-03-13 16:46:26 +01:00

Common.cpp

Swap GetParentProcessId's memset arguments back

2026-10-13 10:57:49 +02:00

Common.h

Not scanning local directory symlinks pointing to network drives

2026-10-07 00:36:56 +02:00

Configuration.cpp

Issue 2455 – Some strings use incorrect translation in 64-bit version

2026-09-01 12:53:54 +02:00

Configuration.h

Issue 2455 – Some strings use incorrect translation in 64-bit version

2026-09-01 12:53:54 +02:00

CopyParam.cpp

Types and casts safe in respect to pointer size for forward 64-bit compatibility

2026-01-22 14:51:13 +01:00

CopyParam.h

Bug 513: Download single large file using multiple SFTP connections

2023-07-27 01:02:51 +02:00

CoreMain.cpp

Getting rid of MFC string loading code

2025-12-19 07:35:02 +01:00

CoreMain.h

Getting rid of MFC string loading code

2025-12-19 07:35:02 +01:00

CorePCH.h

Preparing for separate pre-compiled header file required by Clang

2025-08-22 15:43:55 +02:00

Cryptography.cpp

Issue 2449 – Heap over-read via crafted encrypted filename

2026-06-13 01:04:26 +02:00

Cryptography.h

Clang identifies some functions as "noreturn" + one noexcept(false)

2025-03-14 16:19:14 +01:00

Exceptions.cpp

Avoid redundantly capturing exception stack trace

2025-09-03 12:19:54 +02:00

Exceptions.h

Issue 2232 – Automatically reconnect inactive sessions

2025-04-08 17:20:29 +02:00

FileBuffer.cpp

Shared BOM declaration

2026-01-22 14:53:05 +01:00

FileBuffer.h

Types and casts safe in respect to pointer size for forward 64-bit compatibility

2026-01-22 14:51:13 +01:00

FileInfo.cpp

Refactoring old-style casts

2025-12-18 01:20:33 +01:00

FileInfo.h

Passing password to PuTTY using named pipe instead of commandline

2023-09-19 15:35:05 +02:00

FileMasks.cpp

Types and casts safe in respect to pointer size for forward 64-bit compatibility

2026-01-22 14:51:13 +01:00

FileMasks.h

Clang identifies some functions as "noreturn" + one noexcept(false)

2025-03-14 16:19:14 +01:00

FileOperationProgress.cpp

Refactoring old-style casts

2025-12-18 01:20:33 +01:00

FileOperationProgress.h

Changing compiler to Clang/bcc32c

2025-09-04 07:53:01 +02:00

FileSystems.cpp

#pragma package(smart_init) is not useful out of packages

2025-08-23 01:06:48 +02:00

FileSystems.h

Clang imposed changes that should be noop and have no effect on classic compiler

2025-03-13 16:46:26 +01:00

FtpFileSystem.cpp

Unused code obsoleted by 64050d10

2026-10-03 08:42:27 +02:00

FtpFileSystem.h

Types and casts safe in respect to pointer size for forward 64-bit compatibility

2026-01-22 14:51:13 +01:00

Global.cpp

#pragma package(smart_init) is not useful out of packages

2025-08-23 01:06:48 +02:00

Global.h

Using std::size instead of custom macro

2025-12-07 01:17:54 +01:00

HierarchicalStorage.cpp

Shared BOM declaration

2026-01-22 14:53:05 +01:00

HierarchicalStorage.h

Clang imposed changes that should be noop and have no effect on classic compiler (2nd after 92ba1e3f0 + preceding commits)

2025-06-24 16:32:34 +02:00

Http.cpp

Issue 2447 – Do not allow WebDAV redirects to other hosts by default + Issue 2448 – Do not allow WebDAV redirects to an unencrypted URL by default

2026-06-13 01:00:40 +02:00

Http.h

Issue 2351 – Allow S3 connection with IAM roles on instances that require IMDSv2

2025-02-20 16:17:56 +01:00

Interface.h

Moving abnormal program termination handling to reduce interface

2026-10-16 11:08:10 +02:00

NamedObjs.cpp

Refactoring old-style casts

2025-12-18 01:20:33 +01:00

NamedObjs.h

Clang imposed changes that should be noop and have no effect on classic compiler

2025-03-13 16:46:26 +01:00

NeonIntf.cpp

Issue 2447 – Do not allow WebDAV redirects to other hosts by default + Issue 2448 – Do not allow WebDAV redirects to an unencrypted URL by default

2026-06-13 01:00:40 +02:00

NeonIntf.h

Issue 2447 – Do not allow WebDAV redirects to other hosts by default + Issue 2448 – Do not allow WebDAV redirects to an unencrypted URL by default

2026-06-13 01:00:40 +02:00

Option.cpp

#pragma package(smart_init) is not useful out of packages

2025-08-23 01:06:48 +02:00

Option.h

Unused code

2023-09-19 15:25:49 +02:00

PuttyIntf.cpp

Unused code

2026-10-13 10:47:52 +02:00

PuttyIntf.h

Refactoring old-style casts

2025-12-18 01:20:33 +01:00

PuttyTools.h

Refactoring

2026-04-22 07:33:56 +02:00

Queue.cpp

Using "username" and "hostname" as one word

2026-05-29 01:15:26 +02:00

Queue.h

Issue 2232 – Automatically reconnect inactive sessions

2025-04-08 17:20:29 +02:00

RemoteFiles.cpp

Using variable as intended

2026-05-29 00:51:38 +02:00

RemoteFiles.h

Local directories synchronization fails when preview is disabled, some differences are found, but none are selected

2025-11-11 01:21:11 +01:00

S3FileSystem.cpp

Unused code obsoleted by 64050d10

2026-10-03 08:42:27 +02:00

S3FileSystem.h

Changing compiler to Clang/bcc32c

2025-09-04 07:53:01 +02:00

ScpFileSystem.cpp

Issue 2477 – Recursive SCP directory download allows local path traversal when replacing of invalid characters in filenames is disabled

2026-10-24 00:44:55 +02:00

ScpFileSystem.h

Some (hopefully noop) refactoring to solve Clang internal compiler error when using new variable in __finally block + Some other small code changes imposed by Clang

2025-03-14 16:21:31 +01:00

Script.cpp

Give script rmdir's directory entries a full path

2026-10-13 14:08:14 +02:00

Script.h

Issue 2342 – Command-line interface for installing public key into server

2025-01-25 01:04:17 +01:00

SecureShell.cpp

Issue 2440 – When opening session in PuTTY to a host for which WinSCP has multiple hostkeys cached, use the last key or the key that PuTTY has cached

2026-05-19 00:59:46 +02:00

SecureShell.h

Types and casts safe in respect to pointer size for forward 64-bit compatibility

2026-01-22 14:51:13 +01:00

Security.cpp

Issue 618 – Experimental 64-bit version of WinSCP

2026-05-11 18:39:51 +02:00

Security.h

Optimization

2021-11-26 14:23:12 +01:00

SessionData.cpp

Bug fix: x-name URL parameter was incorrectly decoded

2026-06-26 01:02:43 +02:00

SessionData.h

Bug fix: x-name URL parameter was incorrectly decoded

2026-06-26 01:02:43 +02:00

SessionInfo.cpp

Issue 2447 – Do not allow WebDAV redirects to other hosts by default + Issue 2448 – Do not allow WebDAV redirects to an unencrypted URL by default

2026-06-13 01:00:40 +02:00

SessionInfo.h

Changing compiler to Clang/bcc32c

2025-09-04 07:53:01 +02:00

SftpFileSystem.cpp

Typo in logging

2026-08-25 10:14:29 +02:00

SftpFileSystem.h

Unused declaration (since 5cba2a56)

2026-04-10 01:15:33 +02:00

Terminal.cpp

Unused code obsoleted by 64050d10

2026-10-03 08:42:27 +02:00

Terminal.h

Unused code obsoleted by 64050d10

2026-10-03 08:42:27 +02:00

Usage.cpp

#pragma package(smart_init) is not useful out of packages

2025-08-23 01:06:48 +02:00

Usage.h

Some (hopefully noop) refactoring to solve Clang internal compiler error when using new variable in __finally block + Some other small code changes imposed by Clang

2025-03-14 16:21:31 +01:00

WebDAVFileSystem.cpp

Update to Expat 2.9.0

2026-10-07 11:03:29 +02:00

WebDAVFileSystem.h

Forgotten declaration

2026-10-08 00:35:55 +02:00