romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 13:23:33 +03:00
Code Issues Projects Releases Packages Wiki Activity

urlapi: make dedotdotify handle leading dots correctly

Browse source 
Paths starting with one or two leading dots but without a following
slash were not handled correctly.

Follow-up to c31dd6631f

Extended test 1395 accordingly with a set of new test string.

Reported by Codex Security

Closes #20974
This commit is contained in:
Daniel Stenberg 2026-03-18 09:14:59 +01:00
parent acb4fcb2ef
commit 3f06e27502
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
2 changed files with 44 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

35
tests/unit/unit1395.c
View file

@ -37,6 +37,21 @@ static CURLcode test_unit1395(const char *arg)
};
const struct dotdot pairs[] = {
{ "/%2f%2e%2e%2f/../a", "/a" },
{ "/%2f%2e%2e%2f/../", "/" },
{ "/%2f%2e%2e%2f/.", "/%2f%2e%2e%2f/" },
{ "/%2f%2e%2e%2f/", "/%2f%2e%2e%2f/" },
{ "/%2f%2e%2e%2f", "/%2f%2e%2e%2f" },
{ "/%2f%2e%2e%2", "/%2f%2e%2e%2" },
{ "/%2f%2e%2e%", "/%2f%2e%2e%" },
{ "/%2f%2e%2e", "/%2f%2e%2e" },
{ "/%2f%2e%2", "/%2f%2e%2" },
{ "/%2f%2e%", "/%2f%2e%" },
{ "/%2f%2e", "/%2f%2e" },
{ "/%2f%2", "/%2f%2" },
{ "/%2f%", "/%2f%" },
{ "/%2f", "/%2f" },
{ "/%2", "/%2" },
{ "%2f%2e%2e%2f/../a", "%2f%2e%2e%2f/a" },
{ "%2f%2e%2e%2f/../", "%2f%2e%2e%2f/" },
{ "%2f%2e%2e%2f/.", "%2f%2e%2e%2f/" },
@ -108,6 +123,26 @@ static CURLcode test_unit1395(const char *arg)
{ "/moo/..", "/" },
{ "/..", "/" },
{ "/.", "/" },
{ "////../a", "///a" },
{ "/../../../../../../", "/" },
{ "/..//..//", "//" },
{ "/.config/../ssh", "/ssh" },
{ "/..config/..", "/" },
{ "/.../a", "/.../a" },
{ "/a/%2E%2e/b", "/b" },
{ "/a/%2e./b", "/b" },
{ "/a/.%2e/b", "/b" },
{ "/%2f..%2f", "/%2f..%2f" },
{ "/a/b/.", "/a/b/" },
{ "/a/b/..", "/a/" },
{ "well-known", "well-known" },
{ ".well-known", ".well-known" },
{ "..well-known", "..well-known" },
{ "...well-known", "...well-known" },
{ "....well-known", "....well-known" },
{ "%2ewell-known", "%2ewell-known" },
{ "%2Ewell-known", "%2Ewell-known" },
{ "../.well-known", ".well-known" },
};
for(i = 0; i < CURL_ARRAYSIZE(pairs); i++) {