untrusted comment: verify with openbsd-65-base.pub
RWSZaRmt1LEQT+WUe/2bgbwGu+LLYB9gllvjJyEo/ACKmEjureeDovJLhY1hmh8acP5Bmjde32MfmQnak3vWmLsWpN7gmxVVdQY=
OpenBSD 6.5 errata 026, December 20, 2019:
ftp(1) will follow remote redirects to local files.
Apply by doing:
signify -Vep /etc/signify/openbsd-65-base.pub -x 026_ftp.patch.sig \
-m - | (cd /usr/src && patch -p0)
And then rebuild and install ftp:
cd /usr/src/usr.bin/ftp
make obj
make
make install
Index: usr.bin/ftp/fetch.c
===================================================================
RCS file: /cvs/src/usr.bin/ftp/fetch.c,v
diff -u -p -u -r1.167 fetch.c
--- usr.bin/ftp/fetch.c 10 Feb 2018 06:25:16 -0000 1.167
+++ usr.bin/ftp/fetch.c 19 Dec 2019 00:08:51 -0000
@@ -241,6 +241,9 @@ url_get(const char *origline, const char
} else
errx(1, "url_get: Invalid URL '%s'", newline);
+ if (isfileurl && redirect_loop > 0)
+ errx(1, "Redirection to local file not permitted");
+
if (isfileurl) {
path = host;
} else {
