[svn.haxx.se] · SVN Dev · SVN Users · SVN Org · TSVN Dev · TSVN Users · Subclipse Dev · Subclipse Users · this month's index

SVN-4788: DAV doesn't handle control characters in paths (dav-path-escape branch)

From: Julian Foad <julianfoad_at_apache.org>
Date: Thu, 15 Nov 2018 08:38:28 +0000

SVN-4788: DAV doesn't handle control characters in paths

If a path with a control character exists in the HEAD revision, operations involving this path will fail over DAV, until the offending path has been removed with 'svn rm'.

This bug was initially being tracked as a security issue CVE-2018-1293. Per recommendation of the Apache Security team, this problem is now being treated as a non-security issue. The impact is a DoS which can only be triggered by an authenticated attacker, and is easily resolved with 'svn rm'.

Philip developed a test and a fix (working but incomplete) which is now being developed in public on the 'dav-path-escape' branch.

Branch creation, with the fix in progress:

Description of the fix on the branch:
    "This branch aims to transport control characters in paths over DAV. ..."

- Julian
Received on 2018-11-15 09:38:37 CET

This is an archived mail posted to the Subversion Dev mailing list.

This site is subject to the Apache Privacy Policy and the Apache Public Forum Archive Policy.