goshs

What Changed in v2.1.6

This release turns the old shared clipboard into a full team chat for the web UI and the TUI, and resolves nine coordinated security advisories across the HTTP, WebDAV, SMB, TFTP and collaborator surfaces, plus the usual dependency and CI maintenance.

✨ New Features

• Team chat (replaces the shared clipboard) — The non-persistent clipboard has grown into a live, collaboration-focused chat, synchronized over the websocket hub across every browser and the --tui dashboard (which authors as tui@<host>). Highlights:

  • Markdown rendering with the full :shortcode: emoji catalog (~1800 emoji), composer autosuggest, and collapsible long code blocks.
  • Emoji reactions (with a who-reacted tooltip) and in-place editing of your own messages (↑ in the composer recalls and cycles them; edits are flagged (edited)).
  • Image paste (inlined as base64, or written to disk with --persist-chat-images) and file upload via 📎 (POST /?chatUpload → .goshs-chat/, respects --read-only, hidden from the listing).
  • Own-message highlight and opt-in desktop notifications (🔔 toggle) for others' messages when the tab is hidden.
  • Opt-in persistence — --persist-chat writes the full log (messages, edit flags, per-emoji reaction authors) to <webroot>/.goshs-chat/chat.json and restores it on restart; in memory only by default.

  # Chat is on by default; persist it across restarts and store pasted images on disk
  ./goshs --persist-chat --persist-chat-images
  
  # Disable the chat entirely
  ./goshs --no-chat
  

  Flags: -nc/--no-chat (replaces the old --no-clipboard), -pc/--persist-chat, -pci/--persist-chat-images.

🔒 Security

Nine coordinated advisories, all remotely and (by default) unauthenticated.

Content-destruction / mode-flag bypasses under --no-delete / --upload-only / --read-only (#256) — Across every write protocol, --no-delete/--upload-only now treat overwrite, in-place write, truncate and rename/move of a pre-existing file as deletion-class operations and refuse them, while still allowing new-file creation and the operator's own create→write→rename upload flow.

• SMB WRITE opcode overwrite (GHSA-275v-rxgc-4rcj, High) — the SMB2 WRITE opcode ignored the flags, allowing in-place overwrite of existing files.
• SMB overwrite disposition & SET_INFO truncate (GHSA-jx6h-2x8x-hf5r, High) — FILE_OVERWRITE/OVERWRITE_IF/SUPERSEDE creates and SET_INFO allocation/EOF truncation destroyed existing file contents.
• SMB rename/clobber (GHSA-ppvh-3pc7-mvxw, High) — FileRenameInformation moved and clobbered existing files.
• TFTP --no-delete ignored (GHSA-2q29-798w-6qcp, High) — a TFTP WRQ ignored --no-delete, allowing overwrite and truncation of existing files.
• TFTP WRQ destroys served files (GHSA-vw29-46p5-7h7x, High) — an unauthenticated WRQ could truncate any served file (os.Create implies O_TRUNC).
• HTTP DELETE on block-listed files (GHSA-ppmc-5w4w-2669, High) — incomplete fix of CVE-2026-40189: .goshs block-listed files could still be removed via HTTP DELETE; the block list is now enforced before removal, mirroring the read/share/bulk/WebDAV paths.
• WebDAV LOCK plants empty files (GHSA-whqg-vqcj-px54, Medium) — the library's LOCK handler plants lock-null empty files for absent paths, bypassing --read-only/--upload-only; webdavGuard now refuses LOCK/UNLOCK in those modes.

The four SMB sinks now route through SMBServer.protectExisting(), which blocks only when a flag is set and the path is not one the current session just created.

Credential & ACL exposure (#234)

• Collaborator feed leaks the .goshs Authorization header (GHSA-wfg4-m42q-9pvq, High) — a legitimate write to a .goshs-protected directory carries Authorization: Basic …; the collaborator feed (anonymous when n

What Changed in v2.1.5

This is a security-focused release resolving seven coordinated advisories across the HTTP, WebDAV, FTP and SFTP surfaces, plus a TUI convenience feature and the usual dependency and CI maintenance.

🔒 Security

• HTTP/WebDAV --no-delete/--upload-only overwrite bypass (GHSA-966r-mw4j-rv64, Critical) — The v2.1.4 per-verb WebDAV guard blocked overwriting MOVE/COPY, but the PUT case and the HTTP put()/upload() handlers still gated only on --read-only, so a PUT/POST that overwrote an existing file destroyed its contents under --no-delete and --upload-only. Overwrites of existing files are now blocked whenever deletion is disabled, on both HTTP and WebDAV.
• ConPtyShell.ps1 unauthenticated exemption bypass (GHSA-6m5c-fv2q-jrj2, Critical) — The exemption that lets a caught Windows host fetch ConPtyShell.ps1 was scoped only by the conpty query key and path, not by method or by requiring conpty to be the sole parameter. Appending ?conpty to a request reached most of the authenticated API surface anonymously (bulk download, info, WebSocket/RCE, unauthenticated PUT/DELETE). A shared conPtyExempt() helper now restricts the exemption to a GET/HEAD of exactly /ConPtyShell.ps1 whose only query parameter is conpty; every other method or extra feature key falls through to normal auth.
• WebDAV POST returns file contents, bypassing --upload-only (GHSA-rc9g-fmpg-c6pp, High) — golang.org/x/net/webdav dispatches POST to the same read handler as GET, and the webdavGuard had no POST case, so an unauthenticated POST /file returned the full file body under --upload-only. The guard now treats POST like GET/HEAD and blocks it in upload-only mode.
• FTP ignores --upload-only and only partially enforces --no-delete (GHSA-6wwv-mx7w-35jx, High) — The FTP server never wired the --upload-only flag at all (the whole webroot was readable in upload-only mode), and its --no-delete guard missed rename (RNFR/RNTO) and truncating overwrites. FTP now stacks independent filesystem wrappers: --no-delete blocks deletes, renames and truncating/overwriting writes (appends and new files still allowed), and --upload-only blocks reads while permitting uploads and directory listing.
• Trailing-slash ACL and hidden-file bypass in sendFile (GHSA-964w-f6gj-5236, Medium) — sendFile derived the served filename from the raw request path while opening the file from the cleaned path; a trailing slash emptied the derived name and defeated both the never-serve rule for the .goshs file and the block list. The name is now derived consistently from the cleaned path.
• Single-file ?share redemption served with an empty ACL (GHSA-mqvv-v9g7-4h3j, Medium) — Redeeming a share token for a single file passed an empty configFile{} to sendFile, so neither the block list nor the per-directory basic auth was evaluated. The share redemption path now resolves and enforces the effective ACL, and share minting validates the caller's ACL permissions.
• SFTP server ignored --no-delete (GHSA-4wh5-87mw-whxf, Medium) — The SFTP server had no NoDelete field and never mapped the flag, so Remove/Rmdir/Rename/overwrite stayed available under --no-delete. The flag is now honored, including an overwrite guard on writes.

✨ New Features

• Password reveal popup in the TUI — The --tui status bar shows the basic-auth user but never the password. Pressing p (in any pane except the generator, where p edits LPORT) now opens a modal overlay with the credentials — masked until u toggles plaintext, y/c copy, esc/q close. Handy when the password was generated inline at launch (e.g. -b "user:$(xkcdpass …)"). A bcrypt-hashed secret is shown but flagged as unrecoverable.

🛠️ Build, CI & Packaging

• Migrated the integration test harness to moby/moby (testcontainers 0.43).
• Releases are now s

What Changed in v2.1.4

🔒 Security

• WebDAV --no-delete bypass via MOVE/COPY (GHSA-hq33-8jgp-8qq3) — Under -w --no-delete (and --upload-only), the WebDAV MOVE verb still removed the source file — a rename deletes it from its original path — and, with Overwrite: T, destroyed an existing destination; COPY onto an existing file did the same via an implicit delete. The mode flags are now enforced on these verbs: MOVE is rejected whenever deletion is disabled, and a COPY that would overwrite an existing file is blocked, while a plain COPY to a new path stays allowed. --read-only continues to block all of them.
• SFTP authentication bypass with a single credential (GHSA-rjrw-mjq6-hpmm) — SFTP only installed its password handler when both a username and a password were configured, so setting only one left the server accepting unauthenticated logins. Authentication is now enforced whenever either credential is set.

✨ New Features

• Clipboard copy in the TUI generator — The --tui reverse-shell generator can now copy the selected payload straight to your - clipboard with y/c. It works both locally (xclip/xsel, wl-copy, pbcopy, clip) and over SSH via OSC 52, filling both the system clipboard and the X11 primary selection (Ctrl+V and middle-click / Shift+Insert). The generator tab was also restructured into a stacked layout so multi-line output can be cleanly mouse-selected without also grabbing the menu entries.

🐛 Bug Fixes

• Fatal port-bind errors under --tui — Every listening protocol is now bound before the TUI dashboard takes over the terminal, so a port conflict (or any bind error) is reported cleanly and is fatal up front — instead of being swallowed by a serving goroutine, which under --tui left the terminal in raw mode needing a reset (and was silently dropped entirely for FTP).

⬆️ Dependencies

• Bumped golang.org/x/net 0.53.0 → 0.55.0.
• Bumped GitHub Actions: github/codeql-action (init/autobuild/analyze) 4.36.2 → 4.36.3, and goreleaser/goreleaser-action 7.2.2 → 7.2.3.

What Changed in v2.1.3

✨ New Features

• TFTP server (-tftp / --tftp-server) — goshs can now serve files over TFTP, the one classic transfer protocol it was missing (next to HTTP/WebDAV/FTP/SFTP/SMB). Listens on UDP port 69 by default so built-in clients like Windows' tftp.exe work out of the box, and supports both downloads (RRQ) and uploads (WRQ) with blksize/tsize option negotiation. Honors the IP whitelist and --read-only/--upload-only, rejects path traversal, and is advertised via mDNS. Hand-rolled with zero new dependencies.

# Serve the webroot over TFTP (port 69 needs privileges)
sudo ./goshs -tftp

# Custom, unprivileged port
./goshs -tftp -tftp-port 6900

• Reverse-shell payload generator — A new generator tab in both the web UI and the --tui dashboard builds reverse-shell one-liners from a shared payload database (Bash, nc, Python, PHP, PowerShell, Perl, Ruby, and more), with LHOST/LPORT substitution and optional URL/Base64 encoding (PowerShell payloads as -EncodedCommand).

🐛 Bug Fixes

• TUI interface display (#187) — In --tui mode without an explicit -i, the status line now lists every bound interface IP instead of just showing 0.0.0.0.
• TUI template variables — The status line now reflects every --tpl-var KEY=VALUE entry, not only LHOST/LPORT.
• TUI status line — Enabled FTP/SFTP and TFTP servers are now surfaced in the status bar like the other protocols.
• Config ldap_jndi — The example config shipped a non-binding ldap_jndi_enabled key; the correct, working key is ldap_jndi.
• Config ldap_wordlist — A ldap_wordlist value set via the config file was silently ignored; it is now applied.

🛠️ Build, CI & Packaging

• COPR spec fixes — networking enabled and the debug build disabled so package builds succeed.
• Shell completions (bash/zsh/fish) updated with the new -tftp / --tftp-server / -tftp-port flags.