client.SetWorkingDirectory("..") changes working directory to \

[craig-beuker-enverus]

Greetings,

So I noticed recently that trying to do "SetWorkingDirectory("..")" to go to the parent directory, it's actually taking you to the root folder:

While sitting at a breakpoint in my code, from the immediate window in visual studio:

I am using the FtpClient class.

ftpClient.GetWorkingDirectory()
"/"  // all good, am at root
ftpClient.CreateDirectory("Lemon")
true   // all good, directory created
ftpClient.SetWorkingDirectory("Lemon")
Expression has been evaluated and has no value
ftpClient.GetWorkingDirectory()
"/Lemon"  // all good, am in my Lemon directory
ftpClient.CreateDirectory("Lime")
true  // all good, created Lime directory in Lemon directory
ftpClient.SetWorkingDirectory("Lime")
Expression has been evaluated and has no value
ftpClient.GetWorkingDirectory() 
"/Lemon/Lime"   // all good, am in my /Lemon/Lime directory
ftpClient.SetWorkingDirectory("..")  // to go back to parent directory /Lemon (so I thought) 
Expression has been evaluated and has no value
ftpClient.GetWorkingDirectory()
"/"  // ERROR:  Why am I not in /Lemon?

[FanDjango]

1. I need a verbose log, you should use it also to compare with number 2.
2. Try this with a telnet session and type the PWD, CWD commands yourself, check what the server will do.

FluentFTP Version? Server type? If you would post a verbose log, there would be no need to ask, re-ask and so on and on and on

"/" // ERROR: Why am I not in /Lemon?

That remains a question to analyzed. But you are asking a lot of my crystal ball.

[craig-beuker-enverus]

Sorry bout that. Details as follows:

Version: FluentFtp 54.1.1

Log of session from sample program:
[15:21:19 INF] > Connect(False)
[15:21:19 DBG] FluentFTP 54.1.1.0(.NET 8.0) FtpClient
[15:21:19 DBG] Connecting(sync) FtpClient.FtpSocketStream(control) IP #1 = **:21
[15:21:19 DBG] Waiting for a response
[15:21:19 INF] Response: 220 Microsoft FTP Service [739721.89d]
[15:21:19 INF] Status: Detected FTP server: WindowsServerIIS
[15:21:19 INF] Command: USER ***
[15:21:19 DBG] Waiting for response to: USER ***
[15:21:19 INF] Response: 331 Password required [1ms]
[15:21:19 INF] Command: PASS ***
[15:21:19 DBG] Waiting for response to: PASS ***
[15:21:19 INF] Response: 230 User logged in. [1ms]
[15:21:19 INF] Command: FEAT
[15:21:19 DBG] Waiting for response to: FEAT
[15:21:19 DBG] Response: 211-Extended features supported:
Response: LANG EN
Response: UTF8
Response: AUTH TLS;TLS-C;SSL;TLS-P;
Response: PBSZ
Response: PROT C;P;
Response: CCC
Response: HOST
Response: SIZE
Response: MDTM
Response: REST STREAM
[15:21:19 INF] Response: 211 END [3ms]
[15:21:19 INF] Text encoding: System.Text.UTF8Encoding+UTF8EncodingSealed
[15:21:19 INF] Command: OPTS UTF8 ON
[15:21:19 DBG] Waiting for response to: OPTS UTF8 ON
[15:21:19 INF] Response: 200 OPTS UTF8 command successful - UTF8 encoding now ON. [1ms]
[15:21:19 INF] Command: SYST
[15:21:19 DBG] Waiting for response to: SYST
[15:21:19 INF] Response: 215 Windows_NT [1ms]
[15:21:19 DBG] Active ServerHandler is: WindowsServerIIS
[15:21:19 DBG] Listing parser set to: Windows
[15:21:19 INF] Command: PWD
[15:21:19 DBG] Waiting for response to: PWD
[15:21:19 INF] Response: 257 "/" is current directory. [1ms]
[15:21:19 INF] CWD: /
[15:21:19 INF] > CreateDirectory("Lemon", True)
[15:21:19 INF] > DirectoryExists(".")
[15:21:19 DBG] CreateDirectory Lemon
[15:21:19 INF] Command: MKD Lemon
[15:21:19 DBG] Waiting for response to: MKD Lemon
[15:21:19 INF] Response: 257 "Lemon" directory created. [2ms]
[15:21:19 INF] > SetWorkingDirectory("Lemon")
[15:21:19 INF] Command: CWD Lemon
[15:21:19 DBG] Waiting for response to: CWD Lemon
[15:21:19 INF] Response: 250 CWD command successful. [1ms]
[15:21:19 INF] Command: PWD
[15:21:19 DBG] Waiting for response to: PWD
[15:21:19 INF] Response: 257 "/Lemon" is current directory. [1ms]
[15:21:19 INF] CWD2: /Lemon
[15:21:19 INF] > CreateDirectory("Lime", True)
[15:21:19 INF] > DirectoryExists(".")
[15:21:19 DBG] CreateDirectory Lime
[15:21:19 INF] Command: MKD Lime
[15:21:19 DBG] Waiting for response to: MKD Lime
[15:21:19 INF] Response: 257 "Lime" directory created. [1ms]
[15:21:19 INF] > SetWorkingDirectory("Lime")
[15:21:19 INF] Command: CWD Lime
[15:21:19 DBG] Waiting for response to: CWD Lime
[15:21:19 INF] Response: 250 CWD command successful. [1ms]
[15:21:19 INF] Command: PWD
[15:21:19 DBG] Waiting for response to: PWD
[15:21:19 INF] Response: 257 "/Lemon/Lime" is current directory. [1ms]
[15:21:19 INF] CWD3: /Lemon/Lime
[15:21:19 WRN] Calling command: client.SetWorkingDirectory("..")
[15:21:19 INF] > SetWorkingDirectory("/")
[15:21:19 INF] Command: CWD /
[15:21:19 DBG] Waiting for response to: CWD /
[15:21:19 INF] Response: 250 CWD command successful. [3ms]
[15:21:19 INF] CWD4: /

Sample Program:

using FluentFTP.Logging;
using Serilog;
using Serilog.Extensions.Logging;

namespace ConsoleApp1;

internal class Program
{
	static void Main(string[] args)
	{
		using var log = new LoggerConfiguration()
                                                                .MinimumLevel.Verbose()
								.WriteTo.Console()
								.CreateLogger();


		
		// wrap with MELA ILogger
		var microsoftLogger = new SerilogLoggerFactory(log).CreateLogger("FTP");


		FluentFTP.FtpClient client = new FluentFTP.FtpClient("theftpservernamehere", 21, null);
		client.Logger = new FtpLogAdapter(microsoftLogger);
		client.Credentials = new System.Net.NetworkCredential("theUser", "thePassword");
		client.Connect();

		client.GetWorkingDirectory();
		var cwd = client.GetWorkingDirectory();
		log.Information("CWD: {cwd}", cwd); 
		client.CreateDirectory("Lemon");
		client.SetWorkingDirectory("Lemon");
		var cwd2 = client.GetWorkingDirectory();
		log.Information("CWD2: {cwd2}", cwd2); 
		client.CreateDirectory("Lime");
		client.SetWorkingDirectory("Lime");
		client.GetWorkingDirectory();
		var cwd3 = client.GetWorkingDirectory();
		log.Information("CWD3: {cwd3}", cwd3); 
		log.Warning("Calling command: client.SetWorkingDirectory(\"..\")"); 
		client.SetWorkingDirectory("..");
		var cwd4 = client.GetWorkingDirectory();
		log.Information("CWD4: {cwd4}", cwd4); 
	}
}

Let me know if you need more than that.

Edit: realized I didn't enable verbose logging

[robinrodricks]

Yes this is correct, read https://github.com/robinrodricks/FluentFTP/wiki/Security

To fix use Config.SanitizeTraversal = false

[FanDjango]

Yes, that's it. Note that you can retain security by using the FTP command CDUP via client.Execute("CDUP").

And you can use the sanitize flag any time to turn off and on at will.

[FanDjango]

You can see in the log:

client.SetWorkingDirectory("..")
[15:21:19 INF] > SetWorkingDirectory("/")
[15:21:19 INF] Command: CWD /

The security feature has "modified" the ".." to a "/".

[craig-beuker-enverus]

Ok, so this is a 'by design' feature. If that is the case, I will close this. Let me know.

Will try the Config.SanitizeTraversal = false setting.

Thank you much for your help.

[FanDjango]

You could keep the (newly introduced security enhancement) active - since it does mitigate any vulnerabilities in environments where this is relevant.

You can also turn off/on this flag setting at any time during the course of the session.

Let's leave this open for a while, as this is a recent modification and more users might want to see this.