romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-04 20:16:15 +03:00
Code Issues Projects Releases Packages Wiki Activity

URL sanitize: reject URLs containing bad data

Browse source 
Protocols (IMAP, POP3 and SMTP) that use the path part of a URL in a
decoded manner now use the new Curl_urldecode() function to reject URLs
with embedded control codes (anything that is or decodes to a byte value
less than 32).

URLs containing such codes could easily otherwise be used to do harm and
allow users to do unintended actions with otherwise innocent tools and
applications. Like for example using a URL like
pop3://pop3.example.com/1%0d%0aDELE%201 when the app wants a URL to get
a mail and instead this would delete one.

This flaw is considered a security vulnerability: CVE-2012-0036

Security advisory at: http://curl.haxx.se/docs/adv_20120124.html

Reported by: Dan Fandrich
This commit is contained in:
Daniel Stenberg 2011-12-23 13:24:16 +01:00
parent db1a856b4f
commit 75ca568fa1
5 changed files with 62 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

7
lib/smtp.c
View file

@ -1244,7 +1244,6 @@ static CURLcode smtp_connect(struct connectdata *conn,
struct SessionHandle *data = conn->data;
struct pingpong *pp = &smtpc->pp;
const char *path = conn->data->state.path;
int len;
char localhost[HOSTNAME_MAX + 1];
*done = FALSE; /* default to not done yet */
@ -1316,9 +1315,9 @@ static CURLcode smtp_connect(struct connectdata *conn,
}
/* url decode the path and use it as domain with EHLO */
smtpc->domain = curl_easy_unescape(conn->data, path, 0, &len);
if(!smtpc->domain)
return CURLE_OUT_OF_MEMORY;
result = Curl_urldecode(conn->data, path, 0, &smtpc->domain, NULL, TRUE);
if(result)
return result;
/* When we connect, we start in the state where we await the server greeting
*/