Bug 1164 - scp with spaces username no longer works
Summary: scp with spaces username no longer works
Status: CLOSED FIXED
Alias: None
Product: Portable OpenSSH
Classification: Unclassified
Component: scp (show other bugs)
Version: 4.3p2
Hardware: Other All
: P2 normal
Assignee: Damien Miller
URL:
Keywords:
Depends on:
Blocks: V_6_9 V_8_7
  Show dependency treegraph
 
Reported: 2006-02-26 15:59 AEDT by Darren Tucker
Modified: 2022-02-25 13:55 AEDT (History)
2 users (show)

See Also:


Attachments
Allow spaces in scp usernames (881 bytes, patch)
2006-02-26 16:04 AEDT, Darren Tucker
djm: ok-
Details | Diff
revised diff; check username only for old-style remote->remote copies (840 bytes, patch)
2021-07-02 15:23 AEST, Damien Miller
dtucker: ok+
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Darren Tucker 2006-02-26 15:59:13 AEDT
In 4.2 and below, both of the following work even though they have spaces in the username:
1) scp "user name@host:/path" /path
2) scp /path "user name@host:/path"

This doesn't work (and can't reliably since it effectively does "ssh host1 scp /path user name@host2:/path" so relies on the remote shell):
3) scp "user name@host1:/path" "user name@host2:/path"

In 4.3, 1) still works but 2) doesn't:
$ scp /path "user name@localhost:/path"
user name: invalid user name

I will attach a patch to fix this.  It should allow 1) and 2) while still disallowing 3).
Comment 1 Darren Tucker 2006-02-26 16:04:43 AEDT
Created attachment 1085 [details]
Allow spaces in scp usernames

$ scp "user name@localhost:/path" /path
user name@localhost's password:
$ scp /path "user name@localhost:/path"
user name@localhost's password:
$ scp "user name@localhost:/path" "user name@localhost:/path"
user name: invalid user name

Also fixes a leak of "arg".
Comment 2 Damien Miller 2006-03-12 15:11:18 AEDT
Comment on attachment 1085 [details]
Allow spaces in scp usernames

the patch looks sane, but i don't quite see how it fixes the problem...
Comment 3 Damien Miller 2011-01-24 12:30:53 AEDT
Retarget unclosed bugs from 5.7=>5.8
Comment 4 Damien Miller 2011-09-06 10:34:22 AEST
Retarget unresolved bugs/features to 6.0 release
Comment 5 Damien Miller 2011-09-06 10:36:34 AEST
Retarget unresolved bugs/features to 6.0 release
Comment 6 Damien Miller 2011-09-06 10:39:10 AEST
Retarget unresolved bugs/features to 6.0 release

(try again - bugzilla's "change several" isn't)
Comment 7 Damien Miller 2012-02-24 10:34:31 AEDT
Retarget from 6.0 to 6.1
Comment 8 Damien Miller 2012-02-24 10:38:11 AEDT
Retarget 6.0 => 6.1
Comment 9 Damien Miller 2012-09-07 11:38:27 AEST
Retarget uncompleted bugs from 6.1 => 6.2
Comment 10 Damien Miller 2012-09-07 11:40:48 AEST
Retarget bugs from 6.1 => 6.2
Comment 11 Damien Miller 2013-03-08 10:24:19 AEDT
retarget to openssh-6.3
Comment 12 Damien Miller 2013-07-25 12:18:18 AEST
Retarget to openssh-6.4
Comment 13 Damien Miller 2013-07-25 12:21:20 AEST
Retarget 6.3 -> 6.4
Comment 14 Damien Miller 2014-02-06 10:18:20 AEDT
Retarget incomplete bugs / feature requests to 6.6 release
Comment 15 Damien Miller 2014-02-06 10:20:32 AEDT
Retarget incomplete bugs / feature requests to 6.6 release
Comment 16 Damien Miller 2014-04-12 14:48:22 AEST
Retarget to 6.7 release, since 6.6 was mostly bugfixing.
Comment 17 Damien Miller 2014-04-12 14:53:58 AEST
Remove from 6.6 tracking bug
Comment 18 Damien Miller 2014-08-30 04:38:38 AEST
Retarget incomplete bugs to 6.8 release.
Comment 19 Damien Miller 2014-08-30 04:39:55 AEST
These bugs are no longer targeted at the imminent 6.7 release
Comment 20 Damien Miller 2015-03-03 07:59:47 AEDT
OpenSSH 6.8 is approaching release and closed for major work. Retarget these bugs for the next release.
Comment 21 Damien Miller 2015-03-03 08:01:10 AEDT
Retarget to 6.9
Comment 22 Damien Miller 2015-08-12 11:00:45 AEST
Move unfinished bugs from 6.9 (how did I miss these?) to 7.1
Comment 23 Damien Miller 2016-02-26 14:44:31 AEDT
Retarget to openssh-7.3
Comment 24 Damien Miller 2016-02-26 14:47:21 AEDT
Retarget to openssh-7.3
Comment 25 Damien Miller 2016-07-22 14:10:48 AEST
retarget unfinished bugs to next release
Comment 26 Damien Miller 2016-07-22 14:14:57 AEST
retarget unfinished bugs to next release
Comment 27 Damien Miller 2016-07-22 14:15:42 AEST
retarget unfinished bugs to next release
Comment 28 Damien Miller 2016-07-22 14:17:14 AEST
retarget unfinished bugs to next release
Comment 29 Damien Miller 2016-12-16 14:31:18 AEDT
OpenSSH 7.4 release is closing; punt the bugs to 7.5
Comment 30 Damien Miller 2017-06-30 13:43:06 AEST
Move incomplete bugs to openssh-7.6 target since 7.5 shipped a while back.

To calibrate expectations, there's little chance all of these are going to make 7.6.
Comment 31 Damien Miller 2017-06-30 13:44:28 AEST
remove 7.5 target
Comment 32 Damien Miller 2018-04-06 13:12:14 AEST
Move to OpenSSH 7.8 tracking bug
Comment 33 Damien Miller 2018-08-10 11:37:57 AEST
Retarget remaining bugs planned for 7.8 release to 7.9
Comment 34 Damien Miller 2018-08-10 11:38:25 AEST
Retarget remaining bugs planned for 7.8 release to 7.9
Comment 35 Damien Miller 2018-10-19 17:13:41 AEDT
Retarget unfinished bugs to OpenSSH 8.0
Comment 36 Damien Miller 2018-10-19 17:14:48 AEDT
Retarget unfinished bugs to OpenSSH 8.0
Comment 37 Damien Miller 2018-10-19 17:15:51 AEDT
Retarget unfinished bugs to OpenSSH 8.0
Comment 38 Damien Miller 2019-04-03 10:10:28 AEDT
Retarget outstanding bugs at next release
Comment 39 Damien Miller 2019-10-09 15:07:26 AEDT
Retarget these bugs to 8.2 release
Comment 40 Damien Miller 2020-02-04 11:44:23 AEDT
Prepare for 8.2 release; retarget bugs
Comment 41 Damien Miller 2020-05-08 13:39:21 AEST
Retarget bugs to 8.4 release
Comment 42 Damien Miller 2021-03-04 09:47:03 AEDT
retarget to 8.6
Comment 43 Damien Miller 2021-04-23 14:50:13 AEST
retarget after 8.6p1 release
Comment 44 Damien Miller 2021-07-02 14:58:45 AEST
Comment on attachment 1085 [details]
Allow spaces in scp usernames

this diff is incorrect. The problem is that okname() deliberately refuses names with space characters in them
Comment 45 Damien Miller 2021-07-02 15:23:50 AEST
Created attachment 3534 [details]
revised diff; check username only for old-style remote->remote copies

For the other two cases handled by toremote(), the target username gets passed to ssh via its argv when it is directly execvp() and not by the shell
Comment 46 Damien Miller 2021-07-05 10:26:36 AEST
applied
Comment 47 Damien Miller 2022-02-25 13:55:21 AEDT
closing bugs resolved before the openssh-8.9 release