Subject: Re: [wuftpd] Trailing spaces bug in ftpcmd.y

From: Gregory A Lundberg <[email-masked]>
Date: Fri, 27 Aug 1999 17:18:51 -0400

On Fri, Aug 27, 1999 at 01:55:40PM -0700, Tak wrote:

> I'm not sure if this is a bug or it supposed to behave that way.  If a
> client sends a command w/trailing spaces, the command is unrecognized by
> the parser.
> 
> We stumbled across this while trying to figure out why
> ftp://[email-masked]  (without the trailing slash) from within the
> web browser sometimes returns a "netscape is unable to find the directory
> /.  Check the name and try again" error message.
> 
> After some mucking around with telneting to port 21 and snoop, we found
> that when you leave out the trailing slash in the URL, the Netscape ftp
> client sends "<command> " (Note the trailing space). This is probably a
> bug w/in the client (I assume it's expecting an argument and is doing
> somthing like sprintf(buffer,"%s %s",command, url_args) and if URL_args
> are null, it sticks it on there anyway.  I've filed this as a bug at
> netscape. In any case...
> 
> This happens on any command.  See below:   Line 'u' is a "CWD" and line
> 'x' is a "CWD " (with a trailing space) that fails.  Line Z illustrates
> that it happens on other commands as well.
> 
> My question -- is there a problem with stripping the white space from the
> END of the input line?  In our implementation of the ftp server, we
> changed ftpcmd.y.  Our local version now has a fix to getline() that
> strips trailing spaces before handing it over to the rest of the parser.
> Is this a bad thing for some reason?   Or has it just never come up?

The way I read the RFCs is this:

  A command without parameters must NOT have any trailing spaces.  So

    PWD <SP> <CR> <LF>

  is an invalid command.

  A command taking parameters must have EXACTLY ONE space between the
  command the the parameter.  So

    CWD <SP> /pub <CR> <LF>

  is valid, resulting in the C function

     chdir("/pub");

  where

    CWD <SP> <SP> /pub <CR> <LF>

  is also valid, but probably results in and error.  It becomes the C
  function

    chdir(" /pub");

  Since your cwd probably does not include the directory " ", this probably
  results in an error.

  A command taking an optional parameter must have EXACTLY ONE space when
  the parameter is present, and NOT have any trailing spaces when it is
  not.  So

    CWD <CR> <LF>

  Means "take me home" and becomes the C function

    chdir(pw->pw_dir);

  where

    CWD <SP> <CR> <LF>

  should resolve to either

    chdir(NULL);

  or

    chdir("");

  resulting in an error.  Notice the meaning is "here's a parameter ..
  nothing at all."

In summary, your Netscape web browser is not speaking FTP.  Upgrade to the
latest version.  If the problem recurs, report the bug to Netscape.

-- 

Gregory A Lundberg              WU-FTPD Development Group
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: Tak <[email-masked]>
Date: Fri, 27 Aug 1999 13:55:40 -0700

We stumbled across this while trying to figure out why
ftp://[email-masked]  (without the trailing slash) from within the
web browser sometimes returns a "netscape is unable to find the
directory /.  Check the name and try again" error message.

My question -- is there a problem with stripping the white space from
the END of the input line?  In our implementation of the ftp server, we
changed ftpcmd.y.  Our local version now has a fix to getline() that
strips trailing spaces before handing it over to the rest of the
parser.  Is this a bad thing for some reason?   Or has it just never
come up?

-tak

a. telnet ftp.wu-ftpd.org 21
b. Trying 205.133.13.68...
c. Connected to ftp.wu-ftpd.org.
d. Escape character is '^]'.
e. 220 ftp.wu-ftpd.org FTP server ready.
f. USER ftp
g. 331 Guest login ok, send your complete e-mail address as password.
h. PASS [email-masked]
i. 230-Welcome to the FTP server for the WU-FTPD Development Group
j. 230-
k. 230-This server is the primary distribution site for the WU-FTPD
daemon.
l. 230-
m. 230-The pub directory contains the distribution and supporting files.

n. 230-
o. 230-If you are uploading contributions, please place them in the
incoming
p. 230-directory and email [email-masked] announcing your
upload.
q. 230-
r. 230 Guest login ok, access restrictions apply.
s. PWD
t. 257 "/" is current directory.
u. CWD
v. 250 CWD command successful.
w. CWD
   [ line 'w' has a trailing space. -tak ]
x. 500 'CWD ': command not understood.
y. PASV
   [ line 'y' has a trailing space. -tak ]
z. 500 'PASV ': command not understood.
0. quit

--