Unable to specify upload directory in file stream

[Lukáš Raška <lu...@gmail.com>]

Hello,
we are using Guacamole as part of other application, which is mostly
utilising just the guacamole-common-js library.

Till now we we're using plain output stream with sendBlob method to upload
files to connected server. However due to the 8k limitation in chunk size,
it seems this approach is much slower than it could be. Due to this, we
switched to similar approach as the native guacamole-client is using -
sending the file to dedicated endpoint and then partitioning the file in
backend into 6k chunks before sending it to guacd.


We've successfully benchmarked this approach is faster, but we've found one
issue with file streams creation.

When using for example* client.createFileStream("text/plain",
"/tmp/file.test"),* the ack is errorneous with *SFTP: Illegal filename*,
which is caused by slash characters. When using just *file.test *as
parameter, this uploads just fine into user home folder. So this means we
cannot specify custom path and need to rely on the user home folder (which
might not always work).


Is there any way how to workaround this limitation? I've tried to look into
https://guacamole.apache.org/doc/gug/protocol-reference.html#file-stream-instruction,
but haven't found any option how to specify the directory itself.


Thanks

-- 
Best Regards

Lukáš Raška

Re: Unable to specify upload directory in file stream

[Lukáš Raška <lu...@gmail.com>]

Hi,

st 12. 6. 2019 v 19:51 odesílatel Mike Jumper <mj...@apache.org> napsal:

> On Wed, Jun 12, 2019, 09:17 Lukáš Raška <lu...@raska.me> wrote:
>
>> Hello,
>> so after digging through guacd source, I found out it can be controller
>> via 482201 console code,
>>
>
> Or via the guacctl utility provided to send those codes:
>
> https://github.com/apache/guacamole-server/blob/master/bin/guacctl
>
>
Yup, I noticed that and tested the functionality with guacctl so I don't
have to type those codes myself.



> but it seems it's not configurable via protocol API and seems to affect
>> sftp file transport (couldn't see it in guac_rdp_upload_file_handler,
>> but haven't tested on Windows yet).
>>
>> Are there any plans to unify this behaviour (maybe allow setting the
>> directory with custom protocol and use it for other transports as well)?
>>
>
> The Guacamole protocol does allow for uploading to specific directories
> leveraging the filesystem object. You can see this done in practice in the
> file browser within the Guacamole menu.
>
> Quick fix for my usecase is to ignore filesystem->upload_path in
>> guac_common_ssh_sftp_handle_file_stream, but that does make it dependent on
>> this non-upstream change.
>>
>
> If you are stripping away the code that ensures paths are not included in
> the uploaded filename, you may well be introducing a security vulnerability
> that will allow users to write files anywhere on disk. Upload location is
> intentionally tightly controlled.
>
>
Yeah, that was why I wanted to avoid this in first place. It could be very
easy to introduce some security issue with seemingly irrelevant changes.



> Or is there any other option how to set the upload_path variable which I'm
>> missing?
>>
>
> It's done through the filesystem object and "put" streams:
>
>
> http://guacamole.apache.org/doc/guacamole-common-js/Guacamole.Client.html#event:onfilesystem
>
> http://guacamole.apache.org/doc/guacamole-common-js/Guacamole.Object.html
>
> (See createOutputStream() in particular)
>
> Underlying, low-level protocol:
>
>
> http://guacamole.apache.org/doc/gug/protocol-reference.html#filesystem-object-instruction
>
>
> http://guacamole.apache.org/doc/gug/protocol-reference.html#put-object-instruction
>
> The nature of object stream names is described for "get":
>
>
> http://guacamole.apache.org/doc/gug/protocol-reference.html#get-object-instruction
>
>
Thanks a lot, that works like a charm. createOutputStream() handles the
stream creation, so our backend can now send chunks with blob instruction.



> - Mike
>
>

-- 
Best Regards

Lukáš Raška

Re: Unable to specify upload directory in file stream

[Mike Jumper <mj...@apache.org>]

On Wed, Jun 12, 2019, 09:17 Lukáš Raška <lu...@raska.me> wrote:

> Hello,
> so after digging through guacd source, I found out it can be controller
> via 482201 console code,
>

Or via the guacctl utility provided to send those codes:

https://github.com/apache/guacamole-server/blob/master/bin/guacctl

but it seems it's not configurable via protocol API and seems to affect
> sftp file transport (couldn't see it in guac_rdp_upload_file_handler, but
> haven't tested on Windows yet).
>
> Are there any plans to unify this behaviour (maybe allow setting the
> directory with custom protocol and use it for other transports as well)?
>

The Guacamole protocol does allow for uploading to specific directories
leveraging the filesystem object. You can see this done in practice in the
file browser within the Guacamole menu.

Quick fix for my usecase is to ignore filesystem->upload_path in
> guac_common_ssh_sftp_handle_file_stream, but that does make it dependent on
> this non-upstream change.
>

If you are stripping away the code that ensures paths are not included in
the uploaded filename, you may well be introducing a security vulnerability
that will allow users to write files anywhere on disk. Upload location is
intentionally tightly controlled.

Or is there any other option how to set the upload_path variable which I'm
> missing?
>

It's done through the filesystem object and "put" streams:

http://guacamole.apache.org/doc/guacamole-common-js/Guacamole.Client.html#event:onfilesystem

http://guacamole.apache.org/doc/guacamole-common-js/Guacamole.Object.html

(See createOutputStream() in particular)

Underlying, low-level protocol:

http://guacamole.apache.org/doc/gug/protocol-reference.html#filesystem-object-instruction

http://guacamole.apache.org/doc/gug/protocol-reference.html#put-object-instruction

The nature of object stream names is described for "get":

http://guacamole.apache.org/doc/gug/protocol-reference.html#get-object-instruction

- Mike

Re: Unable to specify upload directory in file stream

[Lukáš Raška <lu...@raska.me>]

Hello,
so after digging through guacd source, I found out it can be
controller via 482201
console code, but it seems it's not configurable via protocol API and seems
to affect sftp file transport (couldn't see it in guac_rdp_upload_file_handler,
but haven't tested on Windows yet).

Are there any plans to unify this behaviour (maybe allow setting the
directory with custom protocol and use it for other transports as well)?
Quick fix for my usecase is to ignore filesystem->upload_path in
guac_common_ssh_sftp_handle_file_stream, but that does make it dependent on
this non-upstream change.

Or is there any other option how to set the upload_path variable which I'm
missing?


Thanks

st 12. 6. 2019 v 12:53 odesílatel Lukáš Raška <lu...@gmail.com> napsal:

> Hello,
> we are using Guacamole as part of other application, which is mostly
> utilising just the guacamole-common-js library.
>
> Till now we we're using plain output stream with sendBlob method to upload
> files to connected server. However due to the 8k limitation in chunk size,
> it seems this approach is much slower than it could be. Due to this, we
> switched to similar approach as the native guacamole-client is using -
> sending the file to dedicated endpoint and then partitioning the file in
> backend into 6k chunks before sending it to guacd.
>
>
> We've successfully benchmarked this approach is faster, but we've found
> one issue with file streams creation.
>
> When using for example* client.createFileStream("text/plain",
> "/tmp/file.test"),* the ack is errorneous with *SFTP: Illegal filename*,
> which is caused by slash characters. When using just *file.test *as
> parameter, this uploads just fine into user home folder. So this means we
> cannot specify custom path and need to rely on the user home folder (which
> might not always work).
>
>
> Is there any way how to workaround this limitation? I've tried to look
> into
> https://guacamole.apache.org/doc/gug/protocol-reference.html#file-stream-instruction,
> but haven't found any option how to specify the directory itself.
>
>
> Thanks
>
> --
> Best Regards
>
> Lukáš Raška
>


-- 
Best Regards

Lukáš Raška