romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-24 23:43:40 +03:00
Code Issues Projects Releases Packages Wiki Activity

urlapi: make dedotdotify handle leading dots correctly

Browse source 
Paths starting with one or two leading dots but without a following
slash were not handled correctly.

Follow-up to c31dd6631f

Extended test 1395 accordingly with a set of new test string.

Reported by Codex Security

Closes #20974
This commit is contained in:
Daniel Stenberg 2026-03-18 09:14:59 +01:00
parent acb4fcb2ef
commit 3f06e27502
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
2 changed files with 44 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

14
lib/urlapi.c
View file

@ -718,8 +718,12 @@ UNITTEST int dedotdotify(const char *input, size_t clen, char **outp)
struct dynbuf out;
CURLcode result = CURLE_OK;
/* variables for leading dot checks */
const char *dinput = input;
size_t dlen = clen;
*outp = NULL;
/* the path always starts with a slash, and a slash has not dot */
/* a single byte path cannot be cleaned up */
if(clen < 2)
return 0;
@ -727,9 +731,9 @@ UNITTEST int dedotdotify(const char *input, size_t clen, char **outp)
/* A. If the input buffer begins with a prefix of "../" or "./", then
remove that prefix from the input buffer; otherwise, */
if(is_dot(&input, &clen)) {
const char *p = input;
size_t blen = clen;
if(is_dot(&dinput, &dlen)) {
const char *p = dinput;
size_t blen = dlen;
if(!clen)
/* . [end] */
@ -737,7 +741,7 @@ UNITTEST int dedotdotify(const char *input, size_t clen, char **outp)
else if(ISSLASH(*p)) {
/* one dot followed by a slash */
input = p + 1;
clen--;
clen = dlen - 1;
}
/* D. if the input buffer consists only of "." or "..", then remove