Nick Craig-Wood 31f3856281 archive/squashfs: don't crash on malformed squashfs images GHSA-6jcg-q3wp-x2f4 CVE-PENDING ...

The archive backend passes remote .sqfs bytes straight to the go-diskfs squashfs
parser, which does not validate several attacker-controlled superblock and
metadata fields. A crafted image can make the parser panic.

Recover panics at the go-diskfs boundary and return an "invalid or corrupt
squashfs image" error instead. As well as the parse entry points (Read, ReadDir,
OpenFile) this wraps the reader returned by Open, since the parser reads file
data lazily and can panic long after the image opened successfully.

Addresses GHSA-6jcg-q3wp-x2f4.

2026-07-31 13:21:59 +01:00

..

alias

config: make getting config values more consistent

2024-08-08 13:41:31 +01:00

all

Add Huawei Drive support

2026-05-01 13:41:07 +01:00

archive

archive/squashfs: don't crash on malformed squashfs images GHSA-6jcg-q3wp-x2f4 CVE-PENDING

2026-07-31 13:21:59 +01:00

azureblob

azureblob: list very large containers in parallel with list_parallelism

2026-07-29 20:16:22 +01:00

azurefiles

azurefiles: improve modtime precision from 1s to 100ns

2026-07-14 14:13:49 +01:00

b2

b2: add server side copy real time accounting

2026-03-03 14:01:11 +00:00

box

box: allow to configure with config file contents

2025-11-18 16:09:06 +00:00

cache

cache: fix test flakiness by stopping the chunk cleaner promptly

2026-07-12 13:26:17 +01:00

chunker

chunker: fix double-transform

2025-06-12 18:31:01 +01:00

cloudinary

cloudinary: fix retrying every error and fix pacer sleep units

2026-05-06 17:47:53 +01:00

combine

combine: don't return an error message as the remote name for a bad object

2026-07-16 14:47:03 +01:00

compress

backend/compress: add zstd compression

2025-11-04 14:50:56 +00:00

crypt

refactor: use strings.Cut to simplify code

2025-11-27 14:42:11 +00:00

doi

docs: fix typos in comments and messages

2026-01-18 20:48:33 +01:00

drime

Revert "drime: disable server side copy as it always fails"

2026-07-27 12:27:02 +01:00

drive

drive: detect shortcut loops to avoid infinite recursion

2026-07-10 18:45:41 +01:00

dropbox

dropbox: remove an unnecessary API call when uploading small files - fixes #9686

2026-07-30 19:30:38 +01:00

fichier

fichier: fix server side move - fixes #7856

2024-09-06 18:20:10 +01:00

filefabric

build: modernize Go usage

2025-02-28 11:31:14 +00:00

filelu

backend/filelu: fix recursive listing path handling and file filtering

2026-06-08 11:54:43 +01:00

filen

filen: fix incorrect modtime after updating a file or setting its modtime

2026-07-13 11:22:04 +01:00

filescom

filescom: fix missing MD5 hash after uploading a file

2026-07-14 14:13:49 +01:00

ftp

ftp: fix ftp command injection when encoding doesn't include CRLF GHSA-8c48-q9wj-3w37 CVE-PENDING

2026-07-31 13:21:59 +01:00

gofile

backend/gofile: update to use new direct upload endpoint

2025-05-27 14:28:25 +01:00

googlecloudstorage

googlecloudstorage: improve endpoint parameter docs

2025-12-01 19:04:02 +00:00

googlephotos

drive, googlephotos: warn in config wizard before using the shared client_id #9580

2026-07-07 12:35:37 +01:00

hasher

hasher: fix Update not storing hashes in bolt DB after file replacement

2026-07-13 10:44:03 +01:00

hdfs

hdfs: fix incorrect modtime after uploading a file or setting its modtime

2026-07-13 13:53:29 +01:00

hidrive

hidrive: fix incorrect modtime after setting a file's modtime

2026-07-14 14:13:49 +01:00

http

http: don't list parent directory when pointing at a single file

2026-05-11 11:05:22 +01:00

huaweidrive

refactor: use slices.Contains to simplify code

2026-05-24 19:57:31 +01:00

iclouddrive

iclouddrive: fix 2FA failing with 409 even when the code is valid

2026-07-29 20:25:57 +01:00

imagekit

imagekit: add mtime to the available metadata

2026-07-17 18:29:39 +01:00

internetarchive

internetarchive: fix server side copy files with spaces

2025-09-04 10:37:27 +01:00

internxt

internxt: surface re-login error when re-auth fails in NewFs

2026-07-10 11:01:57 +01:00

jottacloud

jottacloud: fix incorrect modtime after setting a file's modtime

2026-07-14 14:13:49 +01:00

koofr

docs: fix some function names in comments

2025-06-24 15:04:45 +01:00

linkbox

linkbox: retry bot protection HTML challenge responses instead of failing

2026-07-17 18:29:39 +01:00

local

local: don't resolve relative roots to absolute paths - fixes #9510

2026-07-10 18:45:41 +01:00

mailru

mailru: fix incorrect modtime after updating a file or setting its modtime

2026-07-13 13:49:11 +01:00

mega

mega: fix moved files disappearing from listings between remotes

2026-07-20 17:37:16 +01:00

memory

memory: add --memory-discard flag for speed testing - fixes #9037

2025-12-17 10:21:12 +00:00

netstorage

netstorage: fix missing MD5 hash after uploading a file

2026-07-14 14:13:49 +01:00

onedrive

onedrive: download malware-flagged files via Graph Prefer header

2026-07-28 17:33:55 +01:00

opendrive

opendrive: fix uploaded objects returning the wrong hash and modtime

2026-07-17 18:29:39 +01:00

oracleobjectstorage

oracleobjectstorage: add --oos-decompress flag to download gzip-encoded files

2026-07-30 19:30:08 +01:00

overview

fs/config: add tier to config wizard

2026-07-14 14:16:19 +01:00

pcloud

pcloud: fix recursive listing from the root - fixes #9315

2026-04-20 12:16:10 +01:00

pikpak

build: modernize Go code with go fix for go1.25

2026-02-18 12:11:52 +00:00

pixeldrain

pixeldrain: fix incorrect modtime and missing hash after uploading a file

2026-07-14 14:13:49 +01:00

premiumizeme

about: fix potential overflow of about in various backends

2025-07-31 11:38:51 +01:00

protondrive

protondrive: fix incorrect modtime after uploading a file

2026-07-14 14:13:49 +01:00

putio

putio: fix sync deletions failing with 400 TRASH_LOCK_TIMEOUT errors

2026-07-17 18:29:39 +01:00

qingstor

walk: move NewListRHelper into list.Helper to avoid circular dependency

2025-04-08 15:14:00 +01:00

quatrix

quatrix: fix incorrect modtime after uploading a file

2026-07-14 14:13:49 +01:00

s3

s3: strip S3 Express session token on cross-host redirects GHSA-8mxv-9xhp-86h4

2026-07-31 13:21:59 +01:00

seafile

seafile: don't implement IDer as the id is a content hash not a unique ID

2026-07-09 17:50:26 +01:00

sftp

sftp: fix cmd shell execution of paths containing variable-expansion or newline characters

2026-07-31 13:21:59 +01:00

shade

shade: fix uploads failing with EOF when completing multipart uploads

2026-07-30 14:41:09 +01:00

sharefile

build: modernize Go code with go fix for go1.25

2026-02-18 12:11:52 +00:00

sia

build: modernize Go usage

2025-02-28 11:31:14 +00:00

smb

smb: fix spurious "Directory already exists" errors when moving directories - fixes #9680

2026-07-30 17:50:45 +01:00

storj

build: fix linting issues reported by running golangci-lint with different GOOS

2024-04-22 19:29:12 +02:00

sugarsync

oauthutil: clarify token replacement prompt wording

2026-05-06 10:51:16 +01:00

swift

chore: fix some function names in comments

2026-07-02 11:30:15 +01:00

ulozto

ulozto: fix server side moves between differently rooted remotes losing files

2026-07-17 18:29:39 +01:00

union

build: remove x := x made unnecessary by the new semantics of loops in go1.22

2025-09-14 15:58:20 +01:00

webdav

webdav: tus: fix potential nil pointer crash GHSA-3x6r-wxxg-53vv

2026-07-31 13:21:59 +01:00

yandex

yandex: add --yandex-upload-wait to fix 500 errors when uploading

2026-07-30 20:01:18 +01:00

zoho

zoho: preserve root_folder_id on reconnect and allow setting it

2026-07-16 18:12:00 +01:00