linuxdcpp-team team mailing list archive

[maksis <1665900@xxxxxxxxxxxxxxxxxx>]

Public bug reported:

Starting from version 3.30, AirDC++ refuses to load filelists that
contain directories with duplicate names in case-insensitive context
(since such lists are malformed according to ADC/NMDC specs). However,
this has caused some problems, since at least Eiskalt and Flylink will
happily generate filelists with duplicate item names.

I noticed that DC++ seems reject filelists that contain duplicate item names but only if the casing is equal (https://sourceforge.net/p/dcplusplus/code/ci/0d3e46e86e5e21d6382fa72d6f75944dac40d62f/tree/dcpp/DirectoryListing.h#l77), which is probably also related to https://bugs.launchpad.net/dcplusplus/+bug/1619916
However, item lookups made by path are case-insensitive (https://sourceforge.net/p/dcplusplus/code/ci/0d3e46e86e5e21d6382fa72d6f75944dac40d62f/tree/dcpp/DirectoryListing.h#l165). Depending on how the core is being used, that might raise some security concerns as lookups made by path may return different items that were requested (since the items are not unique in case-insensitive context).

What was the motivation behind making the filelist directory/file sets
case-sensitive? I don't know if I did everything correctly, but based on
my testing, the current case-sensitive comparison function is also
terribly slow: changing it to case-insensitive Util::stricmp reduced the
loading time of my test filelist from 70 seconds to 42 seconds.

** Affects: dcplusplus
     Importance: Undecided
         Status: New

-- 
You received this bug notification because you are a member of
Dcplusplus-team, which is subscribed to DC++.
https://bugs.launchpad.net/bugs/1665900

Title:
  Case-sensitivity in filelists

Status in DC++:
  New

Bug description:
  Starting from version 3.30, AirDC++ refuses to load filelists that
  contain directories with duplicate names in case-insensitive context
  (since such lists are malformed according to ADC/NMDC specs). However,
  this has caused some problems, since at least Eiskalt and Flylink will
  happily generate filelists with duplicate item names.

  I noticed that DC++ seems reject filelists that contain duplicate item names but only if the casing is equal (https://sourceforge.net/p/dcplusplus/code/ci/0d3e46e86e5e21d6382fa72d6f75944dac40d62f/tree/dcpp/DirectoryListing.h#l77), which is probably also related to https://bugs.launchpad.net/dcplusplus/+bug/1619916
  However, item lookups made by path are case-insensitive (https://sourceforge.net/p/dcplusplus/code/ci/0d3e46e86e5e21d6382fa72d6f75944dac40d62f/tree/dcpp/DirectoryListing.h#l165). Depending on how the core is being used, that might raise some security concerns as lookups made by path may return different items that were requested (since the items are not unique in case-insensitive context).

  What was the motivation behind making the filelist directory/file sets
  case-sensitive? I don't know if I did everything correctly, but based
  on my testing, the current case-sensitive comparison function is also
  terribly slow: changing it to case-insensitive Util::stricmp reduced
  the loading time of my test filelist from 70 seconds to 42 seconds.

To manage notifications about this bug go to:
https://bugs.launchpad.net/dcplusplus/+bug/1665900/+subscriptions