untrusted comment: verify with openbsd-66-base.pub
RWSvK/c+cFe24ORiJFTgQw71FNVJsSMmh6uJ82NEEyxzMELEDF3altrSOCjZCIXebhmAIMXtkydEsotopuLS1u0eBDLU1TZ66go=
OpenBSD 6.6 errata 015, December 20, 2019:
ftp(1) will follow remote redirects to local files.
Apply by doing:
signify -Vep /etc/signify/openbsd-66-base.pub -x 015_ftp.patch.sig \
-m - | (cd /usr/src && patch -p0)
And then rebuild and install ftp:
cd /usr/src/usr.bin/ftp
make obj
make
make install
Index: usr.bin/ftp/fetch.c
===================================================================
RCS file: /cvs/src/usr.bin/ftp/fetch.c,v
diff -u -p -u -r1.172 fetch.c
--- usr.bin/ftp/fetch.c 9 Oct 2019 16:43:22 -0000 1.172
+++ usr.bin/ftp/fetch.c 19 Dec 2019 00:08:44 -0000
@@ -243,6 +243,9 @@ url_get(const char *origline, const char
} else
errx(1, "url_get: Invalid URL '%s'", newline);
+ if (isfileurl && redirect_loop > 0)
+ errx(1, "Redirection to local file not permitted");
+
if (isfileurl) {
path = host;
} else {
