Skip to content

Ghost FTP 0.95.28

Choose a tag to compare

View all tags
@github-actions github-actions released this 17 Oct 03:48
v0.95.28
187cdaf
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Ghost FTP 0.95.28 — macOS FTP command control-character safety (development preview)

Expected published predecessor: v0.95.27. The branch must remain unreleased until that predecessor is actually public and immutable.

Native macOS changes

  • Reject all ASCII C0 control codepoints (0x00–0x1F) and DEL (0x7F) in FTP control-channel argument strings, rather than only CR/LF/NUL.
  • Protect the existing FTP-only native username/password, PWD/CWD, listing, upload/download and file-operation command paths through their shared argument validator.
  • Preserve Unicode paths and printable filename spaces.
  • Add XCTest regressions for rejected TAB, ESC/ANSI, BS and DEL filenames/operands, and accepted Unicode paths.
  • Synchronize shared version metadata to 0.95.28 Preview; Windows/Linux and Android feature sets are otherwise unchanged.

Verification and limitations

  • Exact-head macOS unit and real FTP E2E tests.
  • Windows/Linux native builds, Rust/Clippy, Android, product/docs and protocol CI.
  • Real macOS device and server interoperability acceptance.
  • Native macOS explicit FTPS/SFTP, SSH host-key identity, signing/notarization and production distribution — still P0 issue #157.

This is a scoped security improvement, not FileZilla parity or a production-stable release.

Assets 23
Loading