dumpwallet walletfile overwrite footgun #9934

1. 
   gmaxwell commented at 3:05 am on March 7, 2017: contributor

   19:02 < $user> gmaxwell: I have the new version. I opened the console. I ran dumpwallet, and it’s not giving anything back to me. I passed wallet.dat and /Users/pawn/Library/Application\ Support/Bitcoin/wallet.dat as an argument.
2. laanwj added the label RPC/REST/ZMQ on Mar 7, 2017
3. 
   laanwj commented at 8:08 am on March 7, 2017: member

   This is one of the reasons I’d be happier if it would stream the data over the socket, so that the client-side can handle it, instead of overwriting an arbitrary server-side file (which shouldn’t even work with proper sandboxing).

   A quick fix would just be to disallow it overwriting files (possibly overridable with an argument though I’d prefer not).

4. laanwj referenced this in commit 1307cd79b8 on Mar 7, 2017
5. 
   laanwj commented at 8:53 am on March 7, 2017: member

   See #9937.
6. laanwj referenced this in commit cc928c5837 on Sep 22, 2017
7. laanwj referenced this in commit 0cd9273fd9 on Sep 26, 2017
8. laanwj closed this on Oct 4, 2017

   ---

9. laanwj referenced this in commit 7f11ef2608 on Oct 4, 2017
10. MarcoFalke referenced this in commit a43be5bcdb on Oct 4, 2017
11. HashUnlimited referenced this in commit 2ddf6729bc on Mar 12, 2018
12. attilaaf referenced this in commit c2ed1f0bed on May 25, 2019
13. codablock referenced this in commit 9e3cb7599e on Sep 25, 2019
14. barrystyle referenced this in commit 788faa875a on Jan 22, 2020
15. MarcoFalke locked this on Sep 8, 2021

Contributors
gmaxwell laanwj

Labels
RPC/REST/ZMQ