romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 21:03:34 +03:00
Code Issues Projects Releases Packages Wiki Activity

urlapi: URL decode hostname before IP address normalization

Browse source 
With this, IPv6 addresses that end with '%25' with no following zone id are
considered invalid.

Extend test 1560 to verify

Reported-by: Hem Parekh
Closes #21918
This commit is contained in:
Daniel Stenberg 2026-06-09 08:18:18 +02:00
parent 8145476d5d
commit 04afd16076
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
2 changed files with 18 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

17
lib/urlapi.c
View file

@ -658,20 +658,24 @@ static CURLUcode parse_authority(struct Curl_URL *u,
*/
uc = parse_hostname_login(u, auth, authlen, flags, &offset);
if(uc)
goto out;
return uc;
result = curlx_dyn_addn(host, auth + offset, authlen - offset);
if(result) {
uc = cc2cu(result);
goto out;
return uc;
}
uc = parse_port(u, host, has_scheme);
if(uc)
goto out;
return uc;
if(!curlx_dyn_len(host))
return CURLUE_NO_HOST;
uc = CURLUE_NO_HOST;
else
uc = urldecode_host(host);
if(uc)
return uc;
switch(ipv4_normalize(host)) {
case HOST_IPV4:
@ -680,9 +684,7 @@ static CURLUcode parse_authority(struct Curl_URL *u,
uc = ipv6_parse(u, curlx_dyn_ptr(host), curlx_dyn_len(host));
break;
case HOST_NAME:
uc = urldecode_host(host);
if(!uc)
uc = hostname_check(u, curlx_dyn_ptr(host), curlx_dyn_len(host));
uc = hostname_check(u, curlx_dyn_ptr(host), curlx_dyn_len(host));
break;
case HOST_ERROR:
uc = CURLUE_OUT_OF_MEMORY;
@ -692,7 +694,6 @@ static CURLUcode parse_authority(struct Curl_URL *u,
break;
}
out:
return uc;
}