Nick Craig-Wood 756b5e4293 serve docker: reject volume names that escape the base directory GHSA-p6vx-hf7p-98j6 ...

A Docker VolumeDriver.Create request carries a raw volume name that was
joined onto the base directory with filepath.Join and used verbatim as the
mountpoint. filepath.Join collapses ".." components, so a crafted name such
as "../../../etc/foo" resolved to a host path outside the base directory,
where the plugin then created a directory and mounted the remote.

Confine the mountpoint to the base directory and refuse any name that
resolves outside it.

2026-09-04 19:00:22 +01:00

..

about

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

all

gui: new command to launch the https://github.com/rclone/rclone-web/ GUI

2026-04-10 11:39:50 +01:00

archive

build: modernize with "go fix -slicescontains": use slices.Contains

2026-08-21 12:23:31 +01:00

authorize

docs: add link from authorize command docs to remote setup docs

2025-10-02 18:46:16 +02:00

backend

docs: fix markdownlint issues in backend command generated output

2025-11-04 23:00:46 +01:00

bisync

bisync: fix failed transfers of empty files being recorded as synced

2026-09-02 23:47:07 +01:00

cachestats

docs: consistent newline of first line in command output

2024-08-15 18:26:34 +02:00

cat

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

check

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

checksum

docs: consistent newline of first line in command output

2024-08-15 18:26:34 +02:00

cleanup

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

cmount

mountlib: fix VFS instance leaks on mount failures and unmounts

2026-08-18 09:03:12 +01:00

config

config: add config unset command to remove options from a remote - fixes #9541

2026-07-10 18:45:41 +01:00

convmv

build: use "for i := range n", added in go1.22

2025-09-15 12:45:57 +01:00

copy

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

copyto

docs: clarify copyto command description - Fixes #9527

2026-06-29 18:19:49 +01:00

copyurl

build: modernize with "go fix -atomictypes": use sync/atomic types

2026-08-21 12:23:31 +01:00

cryptcheck

fix: comment typos

2025-11-13 13:47:40 +00:00

cryptdecode

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

dedupe

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

delete

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

deletefile

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

genautocomplete

completion: fix powershell completion corrupting non-ASCII names - fixes #9412

2026-06-18 13:28:23 +01:00

gendocs

gendocs: refactor and add logging of skipped command docs

2025-09-02 14:06:31 +02:00

gitannex

gitannex: reduce subprocess launches in end to end test setup

2026-08-02 18:25:09 +01:00

gui

gui: update embedded release to 1.1.11

2026-07-31 12:01:05 +01:00

hashsum

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

link

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

listremotes

listremotes: add --exact flag for filtering - fixes #9076

2026-04-24 16:23:12 +01:00

ls

docs: mention use of ListR feature in ls docs

2025-12-15 09:11:00 +01:00

lsd

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

lsf

lsf: document Google Drive shortcut IDs - fixes #7863

2026-07-24 15:00:09 +01:00

lsjson

docs: fix typos in comments and messages

2026-01-18 20:48:33 +01:00

lsl

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

md5sum

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

mkdir

docs: group the global flags and make them appear on command and flags pages

2023-08-02 12:53:09 +01:00

mount

mountlib: fix VFS instance leaks on mount failures and unmounts

2026-08-18 09:03:12 +01:00

mount2

mountlib: fix VFS instance leaks on mount failures and unmounts

2026-08-18 09:03:12 +01:00

mountlib

serve, mountlib: test VFS release on shutdown and mount failure

2026-08-18 09:03:12 +01:00

move

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

moveto

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

ncdu

ncdu/scan: add unit tests for the scan package

2026-06-05 18:13:16 +01:00

nfsmount

mountlib: fix VFS instance leaks on mount failures and unmounts

2026-08-18 09:03:12 +01:00

obscure

docs: fix echo command syntax for password input

2026-01-18 20:56:26 +01:00

purge

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

rc

rc: flip auth default so all endpoints require auth unless opted out

2026-04-19 13:31:27 +01:00

rcat

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

rcd

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

reveal

docs: add minimum versions to the command pages

2022-12-03 18:58:55 +01:00

rmdir

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

rmdirs

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

selfupdate

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

serve

serve docker: reject volume names that escape the base directory GHSA-p6vx-hf7p-98j6

2026-09-04 19:00:22 +01:00

settier

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

sha1sum

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

size

size: include source in JSON output - fixes #5429

2026-08-13 19:37:59 +02:00

sync

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

test

test speed: fix formatting of help

2025-11-21 17:02:45 +00:00

touch

touch: add metadata when using --metadata-set

2026-02-26 16:20:24 +00:00

tree

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

version

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

cmd.go

build: modernize Go code with go fix for go1.25

2026-02-18 12:11:52 +00:00

completion.go

cmd: make auto completion work for all shells and reduce the size

2024-02-29 14:46:50 +00:00

help.go

docs: don't show fully hidden backend options in the backend docs

2026-07-29 20:16:22 +01:00

progress.go

build: modernize Go code with go fix for go1.25

2026-02-18 12:11:52 +00:00

selfupdate_disabled.go

build: remove build constraint syntax for go 1.16 and older

2024-04-18 16:53:55 +02:00

selfupdate_enabled.go

build: remove build constraint syntax for go 1.16 and older

2024-04-18 16:53:55 +02:00

siginfo_bsd.go

build: update logging statements to make json log work - fixes #6038

2024-09-06 17:04:18 +01:00

siginfo_others.go

build: remove build constraint syntax for go 1.16 and older

2024-04-18 16:53:55 +02:00