romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-04-14 21:31:42 +03:00
Code Issues Projects Releases Packages Wiki Activity

libcurl-security.md: Fix typos and add a point about URLs

Browse source
This commit is contained in:
Dan Fandrich 2026-02-17 12:38:26 -08:00
parent 970e59a82f
commit 36c2c7626f
1 changed files with 7 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

11
docs/libcurl/libcurl-security.md
View file

@ -192,7 +192,7 @@ behind a firewall. Applications can mitigate against this by using the
CURLOPT_FTP_SKIP_PASV_IP(3) option or CURLOPT_FTPPORT(3).
Local servers sometimes assume local access comes from friends and trusted
users. An application that expects https://example.com/file_to_read that and
users. An application that expects https://example.com/file_to_read and
instead gets http://192.168.0.1/my_router_config might print a file that would
otherwise be protected by the firewall.
@ -334,7 +334,10 @@ libcurl programs can use CURLOPT_PROTOCOLS_STR(3) to limit what URL schemes it a
## consider not allowing the user to set the full URL
Maybe just let the user provide data for parts of it? Or maybe filter input to
only allow specific choices?
only allow specific choices? Remember that the naive approach of appending a
user-specified string to a base URL could still allow unexpected results
through use of characters like ../ or ? or Unicode characters or hiding
characters using various escaping means.
# RFC 3986 vs WHATWG URL
@ -387,8 +390,8 @@ hard to avoid.
# Active FTP passes on the local IP address
If you use curl/libcurl to do *active* FTP transfers, curl passes on the
address of your local IP to the remote server - even when for example using a
SOCKS or HTTP proxy in between curl and the target server.
address of your local IP interface to the remote server - even when for example
using a SOCKS or HTTP proxy in between curl and the target server.
# Denial of Service