Repository navigation
KC-1504, KC-1519: Fix Nested Share Folder path resolution ownership bypass, and Prevent duplicate folder names from routing records into attacker-owned shared folders - #2445
Open
sshrushanth-ks wants to merge 4 commits into
Conversation
Prevent attacker-owned shared-in folders from shadowing victim folder paths during NSF record operations. Restrict name resolution to owned folders, prefer owned records during title lookup, reject ambiguous matches, and add regression coverage for record creation and resolution.
sshrushanth-ks
marked this pull request as ready for review
October 16, 2026 12:01
sshrushanth-ks
requested review from
adeshmukh-ks,
amangalampalli-ks,
pvagare-ks and
sali-ks
October 16, 2026 12:02
adeshmukh-ks
left a comment
adeshmukh-ks
left a comment
Contributor
There was a problem hiding this comment.
working on additional changes
and reject path results containing unowned NSF folders. Add regression coverage for attacker-owned NSF folders present in folder_cache.
…folder path components match multiple folders instead of selecting the first result. Prevent record-add from creating unfiled records when --folder cannot be resolved, and add regression coverage for duplicate folder names across record and folder commands.
sshrushanth-ks
changed the title
sshrushanth-ks
changed the title
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
An attacker-owned Nested Share Folder could shadow a victim’s folder path and cause record keys to be wrapped under the attacker’s folder key. Added ownership-aware path resolution, owned-record precedence, and ambiguity handling.
Duplicate classic folder names could cause
record-add,cd,mv, and related commands to select the first matching folder. Added fail-closed folder resolution and preventedrecord-addfrom creating unfiled records when--folderis ambiguous or invalid.Changes
folder_cache.nsf-getfolder resolution to Nested Share Folders.cd,mv,ln,mkdir, andrndir.record-add --folderwhen the folder cannot be resolved.