romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-10 19:30:53 +03:00
Code Issues Projects Releases Packages Wiki Activity

urlapi: '%' is illegal in host names

Browse source 
Update test 1560 to verify

Ref: #10708
Closes #10711
This commit is contained in:
Daniel Stenberg 2023-03-08 13:49:09 +01:00
parent 0546ed54c2
commit 0a0c9b6dfa
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
2 changed files with 3 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

2
lib/urlapi.c
View file

@ -629,7 +629,7 @@ static CURLUcode hostname_check(struct Curl_URL *u, char *hostname,
} }
else { else {
/* letters from the second string are not ok */ /* letters from the second string are not ok */
len = strcspn(hostname, " \r\n\t/:#?!@{}[]\\$\'\"^`*<>=;,+&()"); len = strcspn(hostname, " \r\n\t/:#?!@{}[]\\$\'\"^`*<>=;,+&()%");
if(hlen != len) if(hlen != len)
/* hostname with bad content */ /* hostname with bad content */
return CURLUE_BAD_HOSTNAME; return CURLUE_BAD_HOSTNAME;

6
tests/libtest/lib1560.c
View file

@ -141,6 +141,7 @@ struct clearurlcase {
}; };
static const struct testcase get_parts_list[] ={ static const struct testcase get_parts_list[] ={
{"https://test%test", "", 0, 0, CURLUE_BAD_HOSTNAME},
{"https://example.com%252f%40@example.net", {"https://example.com%252f%40@example.net",
"https | example.com%2f@ | [12] | [13] | example.net | [15] | / " "https | example.com%2f@ | [12] | [13] | example.net | [15] | / "
"| [16] | [17]", "| [16] | [17]",
@ -509,13 +510,10 @@ static const struct urltestcase get_url_list[] = {
{"http://example.com%3a127.0.0.1/", "", 0, 0, CURLUE_BAD_HOSTNAME}, {"http://example.com%3a127.0.0.1/", "", 0, 0, CURLUE_BAD_HOSTNAME},
{"http://example.com%09127.0.0.1/", "", 0, 0, CURLUE_BAD_HOSTNAME}, {"http://example.com%09127.0.0.1/", "", 0, 0, CURLUE_BAD_HOSTNAME},
{"http://example.com%2F127.0.0.1/", "", 0, 0, CURLUE_BAD_HOSTNAME}, {"http://example.com%2F127.0.0.1/", "", 0, 0, CURLUE_BAD_HOSTNAME},
{"https://%this", "https://%25this/", 0, 0, CURLUE_OK},
{"https://h%c", "https://h%25c/", 0, 0, CURLUE_OK},
{"https://%%%%%%", "https://%25%25%25%25%25%25/", 0, 0, CURLUE_OK},
{"https://%41", "https://A/", 0, 0, CURLUE_OK}, {"https://%41", "https://A/", 0, 0, CURLUE_OK},
{"https://%20", "", 0, 0, CURLUE_BAD_HOSTNAME}, {"https://%20", "", 0, 0, CURLUE_BAD_HOSTNAME},
{"https://%41%0d", "", 0, 0, CURLUE_BAD_HOSTNAME}, {"https://%41%0d", "", 0, 0, CURLUE_BAD_HOSTNAME},
{"https://%25", "https://%25/", 0, 0, CURLUE_OK}, {"https://%25", "", 0, 0, CURLUE_BAD_HOSTNAME},
{"https://_%c0_", "https://_\xC0_/", 0, 0, CURLUE_OK}, {"https://_%c0_", "https://_\xC0_/", 0, 0, CURLUE_OK},
{"https://_%c0_", "https://_%C0_/", 0, CURLU_URLENCODE, CURLUE_OK}, {"https://_%c0_", "https://_%C0_/", 0, CURLU_URLENCODE, CURLUE_OK},