From 212178eea1a6f96c8cbeec544935aad1c8b23a54 Mon Sep 17 00:00:00 2001 From: Nick Craig-Wood Date: Wed, 12 Aug 2026 11:54:17 +0100 Subject: [PATCH] serve ftp: add test for auth proxy configured via rc GHSA-p569-5gjg-9cmj CVE-PENDING From v1.70.0 until the serve Provider refactor (f425f8d46), an FTP server started through the rc serve/start API with a per-server proxyOpt.AuthProxy decided whether to enable proxy authentication by checking the process-global proxy.Opt.AuthProxy instead of the supplied proxyOpt.AuthProxy. In the normal rc case the global is empty, so the auth proxy was silently ignored and the server fell back to its fixed-backend mode, whose default account accepts user "anonymous" with any password - a complete authentication bypass. The Provider refactor fixed this incidentally by building the provider from the proxyOpt passed to the constructor. This adds a regression test so the per-server option cannot silently stop working again. --- cmd/serve/ftp/ftp_test.go | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/cmd/serve/ftp/ftp_test.go b/cmd/serve/ftp/ftp_test.go index df6655ac5..ef897c58f 100644 --- a/cmd/serve/ftp/ftp_test.go +++ b/cmd/serve/ftp/ftp_test.go @@ -21,6 +21,7 @@ import ( "github.com/rclone/rclone/lib/israce" "github.com/rclone/rclone/vfs/vfscommon" "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" ) const ( @@ -100,6 +101,27 @@ func TestCheckPasswd(t *testing.T) { } } +// TestNewServerPerServerAuthProxy checks that a per-server proxyOpt.AuthProxy +// enables proxy mode even when the process-global proxy.Opt.AuthProxy is empty, +// which is the normal case when the server is configured via serve/start. +func TestNewServerPerServerAuthProxy(t *testing.T) { + // Ensure the global is empty so we only test the per-server option. + assert.Equal(t, "", proxy.Opt.AuthProxy) + + opt := Opt + opt.ListenAddr = testHOST + ":" + testPORT + opt.PassivePorts = testPASSIVEPORTRANGE + + proxyOpt := proxy.Opt + proxyOpt.AuthProxy = "/path/to/auth/proxy" + + d, err := newServer(context.Background(), nil, &opt, &vfscommon.Opt, &proxyOpt) + require.NoError(t, err) + defer d.provider.Shutdown() + assert.True(t, d.provider.IsProxy(), "expected auth proxy to be enabled by per-server option") + assert.Nil(t, d.provider.VFS(), "expected no fixed VFS when auth proxy is in use") +} + func TestRc(t *testing.T) { if israce.Enabled { t.Skip("Skipping under race detector as underlying library is racy")