Nick Craig-Wood e1b0c09040 archive: hide any archive entry which escapes the directory being listed GHSA-66hp-wgxq-6f5q ...

Whether an archive entry name can escape the archive's namespace was
left entirely to each archiver. Enforce it in the archive backend too.

List only passes on direct children of the directory listed and
NewObject only returns the object asked for, so a future archiver
which forgets to validate names cannot expose a traversal to fs/sync
and fs/operations.

2026-09-04 19:00:22 +01:00

..

alias

config: make getting config values more consistent

2024-08-08 13:41:31 +01:00

all

Add Huawei Drive support

2026-05-01 13:41:07 +01:00

archive

archive: hide any archive entry which escapes the directory being listed GHSA-66hp-wgxq-6f5q

2026-09-04 19:00:22 +01:00

azureblob

azureblob: fix test which didn't compile

2026-08-25 09:31:40 +01:00

azurefiles

build: modernize with "go fix -newexpr": use go1.26 new(expr)

2026-08-21 12:23:31 +01:00

b2

b2: add server side copy real time accounting

2026-03-03 14:01:11 +00:00

box

box: reuse multipart upload part buffers via the global pool

2026-09-01 14:21:52 +01:00

cache

cache: fix test flakiness by stopping the chunk cleaner promptly

2026-07-12 13:26:17 +01:00

chunker

build: modernize with "go fix -stringscut": use strings.Cut

2026-08-21 12:23:31 +01:00

cloudinary

build: modernize with "go fix -newexpr": use go1.26 new(expr)

2026-08-21 12:23:31 +01:00

combine

combine: don't return an error message as the remote name for a bad object

2026-07-16 14:47:03 +01:00

compress

compress: stop buffering the compressibility check output in memory

2026-09-01 14:21:52 +01:00

crypt

crypt: warn about directories with legacy version-like encrypted names

2026-08-27 17:28:04 +01:00

doi

docs: fix typos in comments and messages

2026-01-18 20:48:33 +01:00

drime

Revert "drime: disable server side copy as it always fails"

2026-07-27 12:27:02 +01:00

drive

drive: reuse resumable-upload chunk buffers via multipart.NewRW

2026-08-30 13:07:41 +01:00

dropbox

dropbox: reuse upload chunk buffers via the global memory pool

2026-09-01 14:21:52 +01:00

fichier

fichier: fix server side move - fixes #7856

2024-09-06 18:20:10 +01:00

filefabric

build: modernize Go usage

2025-02-28 11:31:14 +00:00

filelu

filelu: reuse multipart upload buffers via the global pool and retry failed parts

2026-09-01 14:21:52 +01:00

filen

filen: fix incorrect modtime after updating a file or setting its modtime

2026-07-13 11:22:04 +01:00

filescom

build: modernize with "go fix -newexpr": use go1.26 new(expr)

2026-08-21 12:23:31 +01:00

ftp

build: modernize with "go fix -stringscut": use strings.Cut

2026-08-21 12:23:31 +01:00

gofile

build: modernize with "go fix -errorsastype": use errors.AsType

2026-08-21 12:23:31 +01:00

googlecloudstorage

googlecloudstorage: improve endpoint parameter docs

2025-12-01 19:04:02 +00:00

googlephotos

drive, googlephotos: warn in config wizard before using the shared client_id #9580

2026-07-07 12:35:37 +01:00

hasher

hasher: fix Update not storing hashes in bolt DB after file replacement

2026-07-13 10:44:03 +01:00

hdfs

hdfs: fix incorrect modtime after uploading a file or setting its modtime

2026-07-13 13:53:29 +01:00

hidrive

hidrive: buffer small file updates from the global memory pool

2026-09-01 14:21:52 +01:00

http

build: modernize with "go fix -stringscut": use strings.Cut

2026-08-21 12:23:31 +01:00

huaweidrive

huaweidrive: reuse resumable-upload chunk buffers via the global pool

2026-09-01 14:21:52 +01:00

iclouddrive

build: modernize with "go fix -stringscutprefix": use strings.CutPrefix

2026-08-21 12:23:31 +01:00

imagekit

imagekit: add mtime to the available metadata

2026-07-17 18:29:39 +01:00

internetarchive

internetarchive: fix corrupted files being created when the source ends early

2026-08-11 19:32:12 +01:00

internxt

internxt: persist rotated token returned by the user info call

2026-08-27 14:14:40 +01:00

jottacloud

jottacloud: buffer MD5 pre-reads in the global memory pool

2026-09-01 14:21:52 +01:00

koofr

docs: fix some function names in comments

2025-06-24 15:04:45 +01:00

linkbox

linkbox: buffer the hashed 10 MiB file prefix in the global memory pool

2026-09-01 14:21:52 +01:00

local

local: fix panic on Range request past the end of a symlink GHSA-p6m2-r3w9-mpxw CVE-PENDING

2026-09-04 19:00:22 +01:00

mailru

mailru: buffer speedup hashing in the global memory pool and fix upload retries

2026-09-01 14:21:52 +01:00

mega

mega: fix moved files disappearing from listings between remotes

2026-07-20 17:37:16 +01:00

memory

memory: add --memory-discard flag for speed testing - fixes #9037

2025-12-17 10:21:12 +00:00

netstorage

netstorage: fix missing MD5 hash after uploading a file

2026-07-14 14:13:49 +01:00

onedrive

onedrive: reuse upload chunk buffers via the global memory pool

2026-09-01 14:21:52 +01:00

opendrive

opendrive: reuse upload chunk buffers via the global memory pool

2026-09-01 14:21:52 +01:00

oracleobjectstorage

build: modernize with "go fix -newexpr": use go1.26 new(expr)

2026-08-21 12:23:31 +01:00

overview

overview: fix "internal error: no overview data found" on 32 bit architectures - fixes #9723

2026-08-04 19:29:21 +01:00

pcloud

pcloud: fix recursive listing from the root - fixes #9315

2026-04-20 12:16:10 +01:00

pikpak

pikpak: use pooled memory for the gcid hash buffer and spool unknown-size uploads to disk

2026-09-01 14:21:52 +01:00

pixeldrain

pixeldrain: fix incorrect modtime and missing hash after uploading a file

2026-07-14 14:13:49 +01:00

premiumizeme

about: fix potential overflow of about in various backends

2025-07-31 11:38:51 +01:00

protondrive

protondrive: fix Go 1.27 vet warning in retry test

2026-08-29 13:13:34 +01:00

putio

putio: reuse upload chunk buffers via the global memory pool

2026-09-01 14:21:52 +01:00

qingstor

walk: move NewListRHelper into list.Helper to avoid circular dependency

2025-04-08 15:14:00 +01:00

quatrix

quatrix: fix chunk upload retries and fix memory leak

2026-09-01 14:21:52 +01:00

s3

s3: avoid buffering Object Lock uploads when the source MD5 is known

2026-09-01 14:21:52 +01:00

seafile

seafile: don't implement IDer as the id is a content hash not a unique ID

2026-07-09 17:50:26 +01:00

sftp

sftp: implement multi-thread uploads - fixes #8185

2026-08-30 13:06:06 +01:00

shade

shade: stop copying each upload chunk into a second heap buffer

2026-09-01 14:21:52 +01:00

sharefile

build: modernize Go code with go fix for go1.25

2026-02-18 12:11:52 +00:00

sia

sia: fix corrupted files being created when the source ends early

2026-08-11 19:32:12 +01:00

smb

filepool: add generic file handle pool in lib/filepool

2026-08-30 13:06:06 +01:00

storj

build: fix linting issues reported by running golangci-lint with different GOOS

2024-04-22 19:29:12 +02:00

sugarsync

oauthutil: clarify token replacement prompt wording

2026-05-06 10:51:16 +01:00

swift

chore: fix some function names in comments

2026-07-02 11:30:15 +01:00

ulozto

ulozto: fix server side moves between differently rooted remotes losing files

2026-07-17 18:29:39 +01:00

union

build: remove x := x made unnecessary by the new semantics of loops in go1.22

2025-09-14 15:58:20 +01:00

webdav

webdav: fix SetModTime failing and hashes missing on Nextcloud

2026-08-26 12:00:22 +01:00

yandex

yandex: fix truncated files being uploaded successfully when the source ends early

2026-08-21 17:46:05 +01:00

zoho

build: modernize with "go fix -rangeint": use range over int

2026-08-21 12:23:31 +01:00