[Bug 248335] O_BENEATH leaks information about parent directories

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=248335

--- Comment #4 from Dan Gohman <sunfish at mozilla.com> ---
Combined with O_BENEATH allowing `..` to temporarily leave the topping
directory as long as it ends back within the topping directory, one could probe
for any username under /home.

The behaviour which would be best for the present WASI use case would be the
behaviour of Linux's RESOLVE_BENEATH:

    Do not permit the path resolution to succeed if any
    component of the resolution is not a descendant of
    [the topping directory].  This causes absolute
    symbolic links (and absolute values of pathname) to be
    rejected.

-- 
You are receiving this mail because:
You are the assignee for the bug.