romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-09 21:47:18 +03:00
Code Issues Projects Releases Packages Wiki Activity

urlapi: fix parsing URL without slash with CURLU_URLENCODE

Browse source 
When CURLU_URLENCODE is set, the parser would mistreat the path
component if the URL was specified without a slash like in
http://local.test:80?-123

Extended test 1560 to reproduce and verify the fix.

Reported-by: Trail of Bits

Closes #9763
This commit is contained in:
Daniel Stenberg 2022-10-18 15:54:06 +02:00
parent 81094cb492
commit 7d6cf06f57
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
2 changed files with 65 additions and 30 deletions
Download patch file Download diff file Expand all files Collapse all files

18
tests/libtest/lib1560.c
View file

@ -138,6 +138,12 @@ struct clearurlcase {
};
static const struct testcase get_parts_list[] ={
{"https://user@example.net?he l lo",
"https | user | [12] | [13] | example.net | [15] | / | he+l+lo | [17]",
CURLU_ALLOW_SPACE, CURLU_URLENCODE, CURLUE_OK},
{"https://user@example.net?he l lo",
"https | user | [12] | [13] | example.net | [15] | / | he l lo | [17]",
CURLU_ALLOW_SPACE, 0, CURLUE_OK},
{"https://exam{}[]ple.net", "", 0, 0, CURLUE_BAD_HOSTNAME},
{"https://exam{ple.net", "", 0, 0, CURLUE_BAD_HOSTNAME},
{"https://exam}ple.net", "", 0, 0, CURLUE_BAD_HOSTNAME},
@ -849,6 +855,18 @@ static CURLUcode updateurl(CURLU *u, const char *cmd, unsigned int setflags)
}
static const struct redircase set_url_list[] = {
{"http://example.com/please/../gimme/%TESTNUMBER?foobar#hello",
"http://example.net/there/it/is/../../tes t case=/%TESTNUMBER0002? yes no",
"http://example.net/there/tes%20t%20case=/%TESTNUMBER0002?+yes+no",
0, CURLU_URLENCODE|CURLU_ALLOW_SPACE, CURLUE_OK},
{"http://local.test?redirect=http://local.test:80?-321",
"http://local.test:80?-123",
"http://local.test:80/?-123",
0, CURLU_URLENCODE|CURLU_ALLOW_SPACE, CURLUE_OK},
{"http://local.test?redirect=http://local.test:80?-321",
"http://local.test:80?-123",
"http://local.test:80/?-123",
0, 0, CURLUE_OK},
{"http://example.org/static/favicon/wikipedia.ico",
"//fake.example.com/licenses/by-sa/3.0/",
"http://fake.example.com/licenses/by-sa/3.0/",