[SSHD-402] Strange behaviour when overwriting files using SCP (ScpCommandFactory)

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 0.13.0
• Fix Version/s: 0.14.0
• Labels: security
• Environment: Ubuntu 14.10; OpenJDK Runtime Environment (IcedTea 2.5.3) (7u71-2.5.3-0ubuntu1); OpenJDK 64-Bit Server VM (build 24.65-b04, mixed mode)
• Assignee: Guillaume Nodet
• Reporter: Mime Util
• Created: 08/Jan/15 16:13
• Updated: 13/Jan/15 14:42
• Resolved: 13/Jan/15 14:42

Description

I set up a sshd-server als follows:

this.sshd = SshServer.setUpDefaultServer();
this.sshd.setPort(2023);
this.sshd.setKeyPairProvider(new SimpleGeneratorHostKeyProvider("keys"));

List<NamedFactory<UserAuth>> userAuthFactories = new ArrayList<NamedFactory<UserAuth>>();
userAuthFactories.add(new UserAuthNone.Factory());
this.sshd.setUserAuthFactories(userAuthFactories);

this.sshd.setCommandFactory(new ScpCommandFactory());

List<NamedFactory<Command>> namedFactoryList = new ArrayList<NamedFactory<Command>>();
namedFactoryList.add(new SftpSubsystem.Factory());
this.sshd.setSubsystemFactories(namedFactoryList);

After starting the server, I upload a file (scp -P 2023 filename.txt localhost: ) containing:

1234567890

Hexdump (hexdump -C file.txt) of the file is

00000000 31 32 33 34 35 36 37 38 39 30 0a 0a |1234567890..|
0000000c

Afterwards I remove "234567890" from the local file an upload it again. Instead of containing on "1\n" the file contains:

1

4567890

Hexdump (hexdump -C file.txt) of the file is

00000000 31 0a 0a 34 35 36 37 38 39 30 0a 0a |1..4567890..|
0000000c

It seems that "23" is replaced by two newlines and the rest of the original (on the server) remains in the file and is not overwritten.