romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-07 01:38:53 +03:00
Code Issues Projects Releases Packages Wiki Activity

urlapi: detect scheme better when not guessing

Browse source 
When the parser is not allowed to guess scheme, it should consider the
word ending at the first colon to be the scheme, independently of number
of slashes.

The parser now checks that the scheme is known before it counts slashes,
to improve the error messge for URLs with unknown schemes and maybe no
slashes.

When following redirects, no scheme guessing is allowed and therefore
this change effectively prevents redirects to unknown schemes such as
"data".

Fixes #9503
This commit is contained in:
Daniel Stenberg 2022-09-14 09:18:30 +02:00
parent 7f5fe74323
commit 846678541b
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
4 changed files with 30 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

7
lib/transfer.c
View file

@ -1637,7 +1637,7 @@ CURLcode Curl_follow(struct Curl_easy *data,
if((type != FOLLOW_RETRY) &&
(data->req.httpcode != 401) && (data->req.httpcode != 407) &&
Curl_is_absolute_url(newurl, NULL, 0))
Curl_is_absolute_url(newurl, NULL, 0, FALSE))
/* If this is not redirect due to a 401 or 407 response and an absolute
URL: don't allow a custom port number */
disallowport = TRUE;
@ -1649,8 +1649,11 @@ CURLcode Curl_follow(struct Curl_easy *data,
CURLU_ALLOW_SPACE |
(data->set.path_as_is ? CURLU_PATH_AS_IS : 0));
if(uc) {
if(type != FOLLOW_FAKE)
if(type != FOLLOW_FAKE) {
failf(data, "The redirect target URL could not be parsed: %s",
curl_url_strerror(uc));
return Curl_uc_to_curlcode(uc);
}
/* the URL could not be parsed for some reason, but since this is FAKE
mode, just duplicate the field as-is */