romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-05-30 04:27:30 +03:00
Code Issues Projects Releases Packages Wiki Activity

c_escape: escape '?' in generated --libcurl code

Browse source 
In order to avoid the risk of it being used in an accidental trigraph in
the generated code.

Reported-by: Harry Sintonen
Bug: https://hackerone.com/reports/1548535
Closes #8742
This commit is contained in:
Daniel Stenberg 2022-04-25 00:29:22 +02:00
parent cdb9b09793
commit 60452236fa
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
2 changed files with 7 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

6
src/tool_setopt.c
View file

@ -273,6 +273,12 @@ static char *c_escape(const char *str, curl_off_t len)
strcpy(e, "\\\"");
e += 2;
}
else if(c == '?') {
/* escape question marks as well, to prevent generating accidental
trigraphs */
strcpy(e, "\\?");
e += 2;
}
else if(!isprint(c)) {
msnprintf(e, 5, "\\x%02x", (unsigned)c);
e += 4;

2
tests/data/test1403
View file

@ -69,7 +69,7 @@ int main(int argc, char *argv[])
hnd = curl_easy_init();
curl_easy_setopt(hnd, CURLOPT_BUFFERSIZE, 102400L);
curl_easy_setopt(hnd, CURLOPT_URL, "http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER?foo=bar&baz=quux");
curl_easy_setopt(hnd, CURLOPT_URL, "http://%HOSTIP:%HTTPPORT/we/want/%TESTNUMBER\?foo=bar&baz=quux");
curl_easy_setopt(hnd, CURLOPT_USERAGENT, "stripped");
curl_easy_setopt(hnd, CURLOPT_MAXREDIRS, 50L);
curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);