fix(files): skip directory symlinks that loop back onto the scanned path - #63868
Open
nikaiw wants to merge 1 commit into
Open
fix(files): skip directory symlinks that loop back onto the scanned path#63868nikaiw wants to merge 1 commit into
nikaiw wants to merge 1 commit into
Conversation
nikaiw
requested review from
Altahrim,
icewind1991,
leftybournes and
sorbaugh
and removed request for
a team
September 1, 2026 00:14
Member
|
Also #41563 |
joshtrichards
added
bug
3. to review
Contributor
|
Thank you for your contribution! Please follow our AI policy: https://github.com/nextcloud/.github/blob/master/AI_POLICY.md#disclosure |
SUMMARY On a local storage, symlinks to a directories are followed even if the directory is a parent directory or the directory itself. Under these conditions, the Nextcloud metadata scanner continues traversing the tree until it reaches the limit. Re-entering the same tree in loop. Basically it will fill the oc_filecache SQL table with a new entry until the path reach the limit of oc_filecache.path column varchar(4000) Impact We had a server crash because Nextcloud filled the database disk by creating 30M row in this table and producing a 185 GB database. This is a DoS to become that can be triggered just by creating a symlink. History The bug is known since at least 2017 see nextcloud#6395 (SMB), nextcloud#20197, nextcloud#23022 A previous fix nextcloud#21723 was closed unmerged. Proposed Fix Local::getDirectoryContent() will skip a symlink whose target is the directory being listed or a parent directory. We are comparing both path after resolution so that we also catches cycles ( a -> b, b->a ). Signed-off-by: NK <nicolas.devillers@airbus.com> Assisted-by: ClaudeCode:claude-fable-5
nikaiw
force-pushed
the
fix/scanner-symlink-loops
branch
from
September 1, 2026 21:39
2b4ab6f to
ea4a989
Compare
Author
|
done |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
SUMMARY
On a local storage, symlinks to a directories are followed even
if the directory is a parent directory or the directory itself.
Under these conditions, the Nextcloud metadata scanner
continues traversing the tree until it reaches the limit.
Re-entering the same tree in loop.
Basically it will fill the oc_filecache SQL table with a new entry
until the path reach the limit of oc_filecache.path column varchar(4000)
Impact
We had a server crash because Nextcloud filled the database disk
by creating 30M row in this table and producing a 185 GB database.
This is a DoS to become that can be triggered just by creating a symlink.
History
The bug is known since at least 2017 see #6395 (SMB), #20197, #23022
A previous fix #21723 was closed unmerged.
Proposed Fix
Local::getDirectoryContent() will skip a symlink whose target is
the directory being listed or a parent directory.
We are comparing both path after resolution so that we also catches
cycles ( a -> b, b->a ).