New issue
Advanced search Search tips
Note: Color blocks (like █ or █) mean that a user may not be available. Tooltip shows the reason.

Issue 850426 link

Starred by 1 user
Status: Started
Owner:
█ mgiuca@chromium.org
Long OOO (go/where-is-mgiuca)
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 3
Type: Bug

Blocking:
issue 849998



Sign in to add a comment

FTP: Cannot access files with visually-blacklisted characters in filename

Project Member Reported by mgiuca@chromium.org, Jun 7 2018 
Chrome Version: 67.0.3396.62
OS: Linux

What steps will reproduce the problem?
(1) Host a file called "🔒.txt" on an FTP server [see below].
(2) Visit the FTP server in Chrome using the ftp: URL scheme.
(3) Click the file.

What is the expected result?
The file contents is shown.

What happens instead?
ERR_FTP_FAILED

This is the same problem as we saw in  Issue 585422 , but for ftp: URLs instead of file: URLs.

See Issue 849998 for details of the high-level problem. GetRequestPathForFtpCommand in net/ftp/ftp_network_transaction.cc uses URL_SPECIAL_CHARS_EXCEPT_PATH_SEPARATORS which is designed for visual URL displays and avoids decoding characters that might result in visual spoofs. Should use UnescapeBinaryURLComponent instead.

Comment 1 by mgiuca@chromium.org, Jun 7 2018 

[To run an FTP server in Linux]

$ sudo apt install vsftpd

Create a file called /tmp/vsftpd.conf:
"""
listen=YES
listen_address=127.0.0.1
listen_port=9000
anon_root=/tmp/anon_ftp
"""

$ sudo chown root /tmp/vsftpd.conf
$ sudo mkdir /tmp/anon_ftp
$ sudo vsftpd vsftpd.conf

Put some files in /tmp/anon_ftp.

Then point Chrome at ftp://localhost:9000

Comment 2 by mgiuca@chromium.org, Jun 7 2018

Status: Started (was: Assigned)
I logged the TCP stream with Wireshark. Here's opening a normal file with Unicode filename (C is Chrome, S is server):

C: SIZE /你好.txt
S: 213 8
C: CWD /你好.txt
S: 550 Failed to change directory.
C: PASV
S: 227 Entering Passive Mode (127,0,0,1,78,163).
C: RETR /你好.txt
S: 150 Opening BINARY mode data connection for /你好.txt (8 bytes).
S: 226 Transfer complete.

Here's opening 🔒.txt:

C: SIZE /%F0%9F%94%92.txt
S: 550 Could not get file size.
C: CWD /%F0%9F%94%92.txt
S: 550 Failed to change directory.
C: PASV
S: 227 Entering Passive Mode (127,0,0,1,215,152).
C: RETR /%F0%9F%94%92.txt
S: 550 Failed to open file.

As I suspected, Chrome is failing to decode those percent-encoded bytes, and sending that as an FTP path, which is meaningless in the FTP protocol.

Comment 3 by mmenke@chromium.org, Jun 7 2018 

Worth noting that FTP doesn't even specify a character set, so non-UTF-8 names are valid, too.
►

Sign in to add a comment