romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-24 22:43:38 +03:00
Code Issues Projects Releases Packages Wiki Activity

urlapi: deny hostnames with more than one trailing dot

Browse source 
Or consisting of just a single dot.

Such names cannot be resolved with DNS.

While they *can* still be resolved with /etc/hosts or --resolve tricks,
they easily cause internal problems because their trailing dots.

Let's not allow them anymore.

Closes #21622
This commit is contained in:
Daniel Stenberg 2026-05-15 10:14:36 +02:00
parent 88bb7f885f
commit 9135294115
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
3 changed files with 23 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

7
lib/urlapi.c
View file

@ -475,6 +475,13 @@ static CURLUcode hostname_check(struct Curl_URL *u, char *hostname,
if(hlen != len)
/* hostname with bad content */
return CURLUE_BAD_HOSTNAME;
else if((hlen >= 2) &&
(hostname[hlen - 1] == '.') && (hostname[hlen - 2] == '.'))
/* more than one trailing dot is not allowed */
return CURLUE_BAD_HOSTNAME;
else if((hlen == 1) && (hostname[0] == '.'))
/* just a single dot is not allowed */
return CURLUE_BAD_HOSTNAME;
}
return CURLUE_OK;
}