[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: imap4d LIST and DELETE
From: |
Alain Magloire |
Subject: |
Re: imap4d LIST and DELETE |
Date: |
Tue, 22 May 2001 11:09:18 -0400 (EDT) |
>
>
> Is it right that issuing command
>
> a002 LIST "/" *
>
> a user can receive the *whole* directory hierarchy on the server?
8-) Yes.
'*' is a metacharacter that also matches the hierarchy delimiter.
So yes if you do '/*', it will go to your entire file system.
Todo this the metacharacter '%' should be use, '%' does not match '/'.
> The rfc2060 seems to be somehow misty about it, but it seems to be
> a security compromise...
Agreed, it is unfortunate. But remember in IMAP4, LIST was not really meant
to go through filesytems like '/bin/ls'. You could want to this
a00 LIST "" #comp.os.*
To have the entire comp.os hierarchy newsgroup. Or the imapd server
could be on top of an SQL db, so:
a00 LIST "/" *
may make sense.
But I agree it is a security concern, I've look at for example the c-client
imap4d and its doing the same i.e. going through the entire filesystem.
So I'm not sure how to deal with this.
> Another security question: issuing
>
> a002 DELETE filename
>
> deletes the `filename' even if it is not a valid maildrop. Is IMAP4
> supposed to operate on any regular files or just on maildrops? Maybe
> we would be better off restricting the critical operations (like DELETE)
> to valid maildrops only?
The question is how do you detect a valid mailbox?
a001 CREATE filename
a001 OK Create completed // an empty file ?
a002 DELETE filename
????
a002 OK Delete completed
And you are allowed remove a hierarchy
a001 DELETE /home/user/Mail/folder1/
We could restrict CREATE/DELETE/RENAME etc ... to /home/user/Mail/*
when accessing the filesystem? But is that the right approach ?
is it not to restrictive? Is there an actual benifice/advantage?
--
au revoir, alain
----
Aussi haut que l'on soit assis, on n'est toujours assis que sur son cul !!!