DMARC-Filter: OpenDMARC Filter v1.4.2 delorie.com 55C0wT9F4129360
DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 13E823837522
Date: Wed, 11 Jun 2025 17:57:20 -0700 (PDT)
To: Sam Edge via Cygwin <cygwin@cygwin.com>
Subject: Re: Path prefix //./ in Cygwin
In-Reply-To: <2fcf0555-2ea5-41d1-bd42-68fab89a189a@gmx.com>
Message-ID: <b4cbb08a-52b8-fd53-f85b-825b465cd61a@jdrake.com>
References: <93fd79f3-bb39-79c2-8e78-57c4af356e54@jdrake.com>
 <2fcf0555-2ea5-41d1-bd42-68fab89a189a@gmx.com>
MIME-Version: 1.0
Precedence: list
From: Jeremy Drake via Cygwin <cygwin@cygwin.com>
Reply-To: Jeremy Drake <cygwin@jdrake.com>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cygwin-bounces~archive-cygwin=delorie.com@cygwin.com
Sender: "Cygwin" <cygwin-bounces~archive-cygwin=delorie.com@cygwin.com>

On Thu, 12 Jun 2025, Sam Edge via Cygwin wrote:

> I would think that if you're building something against Cygwin, it's probably
> best to assume it's POSIX where only forward-slash is special and not try to
> second-guess.

This is unsafe, and actually where the rust PR started out.  If you only
treat '/' as special, a program may be tricked into allowing path
traversal with file/directory names like '..\..' or 'C:\Windows' which
are not path traversing or absolute paths in POSIX.

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple