romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-10 03:27:18 +03:00
Code Issues Projects Releases Packages Wiki Activity

gopher: reject CR and LF in the selector

Browse source 
Verifed in test 1609

Closes #22116
This commit is contained in:
alhudz 2026-06-20 15:02:19 +05:30 • committed by Daniel Stenberg
parent d786a85f19
commit 65d8eaeaa2
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
3 changed files with 49 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

10
lib/gopher.c
View file

@ -103,6 +103,16 @@ static CURLcode gopher_do(struct Curl_easy *data, bool *done)
if(result)
return result;
buf = buf_alloc;
/* A decoded CR or LF would terminate the single-line gopher request and
let a crafted URL smuggle additional bytes onto the wire. REJECT_ZERO
only blocks NUL; reject CR and LF here too. A TAB is left alone as it
is the legitimate gopher type-7 selector/search separator. */
if(memchr(buf, '\r', buf_len) || memchr(buf, '\n', buf_len)) {
curlx_free(buf_alloc);
failf(data, "Bad gopher selector, CR or LF not allowed");
return CURLE_URL_MALFORMAT;
}
}
for(; buf_len;) {

2
tests/data/Makefile.am
View file

@ -211,7 +211,7 @@ test1573 test1574 test1575 test1576 test1577 test1578 test1579 test1580 \
test1581 test1582 test1583 test1584 test1585 test1586 test1587 test1588 \
test1589 test1590 test1591 test1592 test1593 test1594 test1595 test1596 \
test1597 test1598 test1599 test1600 test1601 test1602 test1603 test1604 \
test1605 test1606 test1607 test1608 test1610 test1611 test1612 \
test1605 test1606 test1607 test1608 test1609 test1610 test1611 test1612 \
test1613 test1614 test1615 test1616 test1617 test1618 test1619 test1620 \
test1621 test1622 test1623 test1624 test1625 test1626 test1627 test1628 \
test1629 test1630 test1631 test1632 test1633 test1634 test1635 test1636 \

38
tests/data/test1609 Normal file
View file

@ -0,0 +1,38 @@
<?xml version="1.0" encoding="US-ASCII"?>
<testcase>
<info>
<keywords>
GOPHER
CRLF-in-URL
</keywords>
</info>
# Server-side
<reply>
</reply>
# Client-side
<client>
<server>
gopher
</server>
<name>
Gopher with URL-encoded CR LF in the selector
</name>
<command>
gopher://%HOSTIP:%GOPHERPORT/1/sel%0d%0aINJECT/%TESTNUMBER
</command>
</client>
# Verify data after the test has been "shot"
<verify>
# 3 - CURLE_URL_MALFORMAT
<errorcode>
3
</errorcode>
# nothing must reach the server, the selector is rejected before any send
<protocol nonewline="yes">
</protocol>
</verify>
</testcase>