Bug 503936 - Premature SFTP connections during username/address entry
Summary: Premature SFTP connections during username/address entry
Status: REPORTED
Alias: None
Product: dolphin
Classification: Applications
Component: bars: location (other bugs)
Version First Reported In: 25.04.0
Platform: Debian testing Linux
: NOR normal
Target Milestone: ---
Assignee: Dolphin Bug Assignee
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-05-08 17:52 UTC by Brendon Higgins
Modified: 2025-05-08 17:52 UTC (History)
1 user (show)

See Also:
Latest Commit:
Version Fixed In:
Sentry Crash Report:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Brendon Higgins 2025-05-08 17:52:57 UTC
SUMMARY

Dolphin prematurely attempts to connect to SFTP server for each value of the address field while the user is in the process of editing it. For example (and how I noticed), I had an SFTP address loaded but realized I wanted to log in under a different user, so I selected the username (preceding "@" in the URL), typed the new username, and pressed enter.

By then the server had blocked my IP address because of too many failed login attempts (it's using fail2ban). I was able to check the auth.log file afterwards, and it had this sort of thing logged from the sshd process:
Invalid user s from XX.XX.XX.XX port 53XXX
Invalid user sh from XX.XX.XX.XX port 53XXX
error: maximum authentication attempts exceeded for invalid user s from XX.XX.XX.XX port 53XXX ssh2 [preauth]
Invalid user sha from XX.XX.XX.XX port 53XXX
Invalid user shar from XX.XX.XX.XX port 53XXX
...

Is this maybe triggered by a path completion feature being too eager?

STEPS TO REPRODUCE
1. Connect to SFTP server.
2. Edit user name in address bar.

OBSERVED RESULT

Observe logs of each keypress causing a login attempt on the server. Or a temporary ban, depending on how the server is configured.

EXPECTED RESULT

No such spurious attempts in the server log, no temp ban. I would think Dolphin should wait until the URL (or at least the username+domain part?) is complete/ENTER is pressed before attempting to log in.

SOFTWARE/OS VERSIONS
Operating System: Debian GNU/Linux 
KDE Plasma Version: 6.3.4
KDE Frameworks Version: 6.13.0
Qt Version: 6.8.2
Kernel Version: 6.12.25-amd64 (64-bit)
Graphics Platform: X11
Processors: 16 × AMD Ryzen 7 3700X 8-Core Processor
Memory: 31.3 GiB of RAM
Graphics Processor: AMD Radeon RX 570 Series