Re: wget2 | wget -r --no-host-directories in $HOME should be taken care of (#489)

[Tim Rühsen]

Tim Rühsen commented:


```
> Similar situations can arise from running "wget --recursive
> --no-directories" in the home directory. In this case, I don't think we
> should work to avoid server-chosen names, since that's a fundamental
> functionality change to wget, and in any case can't realistically be
> done (I see your patch doesn't try). Instead, for this case we should
> probably add something to the documentation for --no-directories warning
> that you shouldn't use it if wget will be placing files directly in your
> home directory or a similar sensitive location.
```

It says that --recursive implies server-chosen names (what i said above). So 
from the security standpoint, nothing speaks against implicit 
--trust-server-names.

It also says that there should be a warning about placing files into $HOME in 
case of using --no-directories. I can't see this warning in the man page.

-- 
Reply to this email directly or view it on GitLab: 
https://gitlab.com/gnuwget/wget2/issues/489#note_243942611
You're receiving this email because of your account on gitlab.com.