Bug 424 - scp mishandles files with spaces in names
Summary: scp mishandles files with spaces in names
Status: CLOSED WONTFIX
Alias: None
Product: Portable OpenSSH
Classification: Unclassified
Component: scp (show other bugs)
Version: -current
Hardware: All Linux
: P2 normal
Assignee: OpenSSH Bugzilla mailing list
URL:
Keywords:
: 957 (view as bug list)
Depends on:
Blocks:
 
Reported: 2002-11-02 07:36 AEDT by David desJardins
Modified: 2008-11-03 08:04 AEDT (History)
2 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description David desJardins 2002-11-02 07:36:29 AEDT
Reproduce as follows:

% touch "123 456"
% scp "123 456" 789
cp: copying multiple files, but last argument `789' is not a directory
Try `cp --help' for more information.

Using 'cp' works fine in this case.

The same problem occurs in many other cases, e.g., when using scp -r with a
directory which has a space in its name.
Comment 1 Damien Miller 2003-01-03 15:16:20 AEDT
Known, and unfixable, problem with the rcp protocol. A workaround is to
double-quote spaces:

scp "foo\ bar" foo:

We can't fix a 20+ year old, deployed protocol.
Comment 2 Damien Miller 2004-04-14 12:24:18 AEST
Mass change of RESOLVED bugs to CLOSED
Comment 3 Robin Green 2004-12-01 05:33:00 AEDT
*** Bug 957 has been marked as a duplicate of this bug. ***
Comment 4 Anders Kaseorg 2008-11-03 08:04:05 AEDT
Can someone explain why this is a protocol problem?  If there’s a client-side workaround, why isn’t the filename escaped in the scp client?

This is a potentially nasty security problem for a trusted script that scps files from a remote machine, because a malicious filename containing `` could cause arbitrary code to be executed remotely.

A similar problem exists with the ssh client:

$ touch "123 456" 789; ls
123 456
789
$ ssh host touch "123 456" 789; ssh host ls
123
456
789