In sqlite3-rsync, do not allow the '/' character to appear anywhere in the

USER@HOST: prefix to one of the argument databases.

FossilOrigin-Name: 6089a90463dcb3ba8e1584cfc5e2528fbc131311c6df7834fb41a5614a8ca9e8

3 files changed, 32 insertions, 10 deletions

diff --git a/manifest b/manifest
index 2a0798d16..fdb957972 100644
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Fix\sa\stypo\sin\san\serror\smessage\sin\ssqlite3-rsync.
-D 2024-09-16T20:53:52.963
+C In\ssqlite3-rsync,\sdo\snot\sallow\sthe\s'/'\scharacter\sto\sappear\sanywhere\sin\sthe\nUSER@HOST:\sprefix\sto\sone\sof\sthe\sargument\sdatabases.
+D 2024-09-17T10:36:33.368
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724
@@ -2174,7 +2174,7 @@ F tool/speedtest8inst1.c 7ce07da76b5e745783e703a834417d725b7d45fd
 F tool/spellsift.tcl 52b4b04dc4333c7ab024f09d9d66ed6b6f7c6eb00b38497a09f338fa55d40618 x
 F tool/split-sqlite3c.tcl 5aa60643afca558bc732b1444ae81a522326f91e1dc5665b369c54f09e20de60
 F tool/sqldiff.c 847fc8fcfddf5ce4797b7394cad6372f2f5dc17d8186e2ef8fb44d50fae4f44a
-F tool/sqlite3-rsync.c 954e3970ee4f26734a536b1516bc2cedc565ea90b33cfde4a685dacb7ee904b5
+F tool/sqlite3-rsync.c eecb69a732b74da0bc794d13fac620b2290ba0ea75fb7fe849dd4042a0d1aba8
 F tool/sqlite3_analyzer.c.in 8da2b08f56eeac331a715036cf707cc20f879f231362be0c22efd682e2b89b4f
 F tool/sqltclsh.c.in 1bcc2e9da58fadf17b0bf6a50e68c1159e602ce057210b655d50bad5aaaef898
 F tool/sqltclsh.tcl 862f4cf1418df5e1315b5db3b5ebe88969e2a784525af5fbf9596592f14ed848
@@ -2213,8 +2213,8 @@ F vsixtest/vsixtest.tcl 6195aba1f12a5e10efc2b8c0009532167be5e301abe5b31385638080
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P 8c5e481b49d86d97fefa345d0c1b96c050846ef9fc51d8b9dd203ee35afd6f6d
-R 9739c80c68e6be73946faa583451da20
+P 3f25d6c8eac25de4afff486b134a339bc06404ddaed15b46db48c6770535b1e6
+R df865d4fc563bc0dba15ce1b91e4f9dd
 U drh
-Z e2729245bc18c6a9a02f3744568f0c8f
+Z 4026393b6076216ed6e2d38e7942413d
 # Remove this line to create a well-formed Fossil manifest.
diff --git a/manifest.uuid b/manifest.uuid
index fd4f32a87..4e71c0750 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-3f25d6c8eac25de4afff486b134a339bc06404ddaed15b46db48c6770535b1e6
+6089a90463dcb3ba8e1584cfc5e2528fbc131311c6df7834fb41a5614a8ca9e8
diff --git a/tool/sqlite3-rsync.c b/tool/sqlite3-rsync.c
index 1df99c10d..871d4f2a2 100644
--- a/tool/sqlite3-rsync.c
+++ b/tool/sqlite3-rsync.c
@@ -1547,6 +1547,28 @@ sqlite3_int64 currentTime(void){
 }
 
 /*
+** Input string zIn might be in any of these formats:
+**
+**    (1) PATH
+**    (2) HOST:PATH
+**    (3) USER@HOST:PATH
+**
+** For format 1, return NULL.  For formats 2 and 3, return
+** a pointer to the ':' character that separates the hostname
+** from the path.
+*/
+static char *hostSeparator(const char *zIn){
+  char *zColon;
+  char *zDirSep;
+
+  zColon = strchr(zIn, ':');
+  if( zColon==0 ) return 0;
+  zDirSep = strchr(zIn, '/');
+  if( zDirSep==0 || zDirSep>zColon ) return zColon;
+  return 0;
+}
+
+/*
 ** Parse command-line arguments.  Dispatch subroutines to do the
 ** requested work.
 **
@@ -1711,9 +1733,9 @@ int main(int argc, char const * const *argv){
     return 1;
   }
   tmStart = currentTime();
-  zDiv = strchr(ctx.zOrigin,':');
+  zDiv = hostSeparator(ctx.zOrigin);
   if( zDiv ){
-    if( strchr(ctx.zReplica,':')!=0 ){
+    if( hostSeparator(ctx.zReplica)!=0 ){
       fprintf(stderr,
          "At least one of ORIGIN and REPLICA must be a local database\n"
          "You provided two remote databases.\n");
@@ -1744,7 +1766,7 @@ int main(int argc, char const * const *argv){
       return 1;
     }
     replicaSide(&ctx);
-  }else if( (zDiv = strchr(ctx.zReplica,':'))!=0 ){
+  }else if( (zDiv = hostSeparator(ctx.zReplica))!=0 ){
     /* Local ORIGIN and remote REPLICA */
     sqlite3_str *pStr = sqlite3_str_new(0);
     append_escaped_arg(pStr, zSsh, 1);