Criado 21 de dez. de 2017
Modificado 8 de nov. de 2022

Introduction

The FTP server running at ftp.box.com has several defects and issues. All of the issues presented here have been reported to Box in the past. While Box has acknowledged them, they show no intention to address them. We strongly recommend to use the native Box protocol and not the FTP protocol when connecting to Box.

Defects

Defect: RMD Protocol Violation

Problem

The server sends 2 replies (2 lines) in the reply to RMD when the directory is not empty. In addition, the 2nd reply is wrong and the directory is in fact not removed.

Example

RMD c
450 Box: Cannot delete - folder not empty (code=folder_not_empty, request_id=j7mx0yfmoadm05v8).
250 "/fdgsdgsd/c" removed.

Implications

Deleting non-empty folders breaks the FTP protocol sequence.

Defect: MLST and special characters

Problem

The server returns a "success" reply for non-existing items if the file name contains of any these characters:
[ * ?
The MLST response contains the data from the current working directory.

Examples

MLST test[
250-
Size=36479514;Modify=20171221053420.000;Create=20170420182729.000;Type=dir;Perm=elfpcm; fdgsdgsd

250 Requested file action okay, completed.

MLST a*a
250-
Size=36479514;Modify=20171221182532.000;Create=20170420182729.000;Type=dir;Perm=elfpcm; fdgsdgsd

250 Requested file action okay, completed.

When the name does not contain any "special" chars, the server replies with:
MLST test
501 Not a valid pathname.

Implications

False positives for file existence checks. Folders with these "special" characters cannot be created.

Defect: Data loss with multiple connections

Problem

When creating folders in multiple concurrent connections, some folders (including their empty sub folders) suddenly disappear.

Example

2017-12-21T05:00:38Z 257 "/fdgsdgsd/c" is current directory.
2017-12-21T05:00:38Z MKD b - Copy - Copy (2)
2017-12-21T05:00:38Z 257 "/fdgsdgsd/c/b - Copy - Copy (2)" created.
2017-12-21T05:00:38Z MLST b - Copy - Copy (2)
2017-12-21T05:00:39Z 250-
Size=0;Modify=20171221050022.000;Create=20171221050022.000;Type=dir;Perm=elfpcm; b - Copy - Copy (2)

250 Requested file action okay, completed.
2017-12-21T05:00:39Z Command not implemented for argument.
2017-12-21T05:00:39Z CWD /fdgsdgsd/c/b - Copy - Copy (2)
2017-12-21T05:00:39Z 250 Directory changed to /fdgsdgsd/c/b - Copy - Copy (2)
2017-12-21T05:00:39Z PWD
2017-12-21T05:00:39Z 257 "/fdgsdgsd/c/b - Copy - Copy (2)" is current directory.

.. and a bit later in a different connection the folder no longer exists:

2017-12-21T05:22:06Z CWD /fdgsdgsd/c/b - Copy - Copy (2)
2017-12-21T05:22:06Z 550 No such directory.

Implications

Data loss when uploading files/folders with multiple connections.

Defect: Wrong MLST error message

Problem

When MLST for a non-existing item is sent, the server returns the wrong error message.

Example

The error message should say something like file not found etc. Not that the path is invalid.
MLST alphatest2.bmp
501 Not a valid pathname.

Correct behavior

The correct error message should be something like:
550 File not found

Implications

Unreliable file exist detection.

Defect: STOR error message comes too late

Problem

When trying to restart/resume a transfer, the error messages comes too late in the command sequence.

Example

REST 1552384
350 Restarting at 1552384. Send STORE or RETRIEVE to initiate transfer.
STOR ShellStreams92.zip
150 File status okay; about to open data connection.
65536 bytes transferred. (Unknown/s) (0 ms)
551 Box: Partial-file uploads are not supported.

Correct behavior

The error message should come right after the REST command if the REST command (if restart position is not equal to 0) or alternatively right after the STOR command (no 150 reply):
REST 1552384
551 Box: Partial-file uploads are not supported.

STOR ShellStreams92.zip
551 Box: Partial-file uploads are not supported.

Implications

Unnecessary data transfers.

Other Issues

MFCT not supported for folders

Problem

Setting the date created for folders is not supported.

Example

MFCT 20171221042140 myfolder
501 Command Not Implemented for the Specified Arguments