romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-26 08:03:31 +03:00
Code Issues Projects Releases Packages Wiki Activity

ftp: reject control bytes in ACCT and alternative-to-user

Browse source 
A CR or LF in the CURLOPT_FTP_ACCOUNT or CURLOPT_FTP_ALTERNATIVE_TO_USER
string split the control-channel command line and smuggled a second FTP
command. Reject a byte below 0x20 in both values before the command is
built.

Closes #22301
This commit is contained in:
Alhuda Khan 2026-07-12 17:31:44 +05:30 • committed by Daniel Stenberg
parent c3f9ef13f6
commit 9494750986
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
4 changed files with 129 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

51
lib/ftp.c
View file

@ -2927,6 +2927,20 @@ static CURLcode ftp_state_loggedin(struct Curl_easy *data,
return result;
}
/* A value that becomes part of an FTP control command must not carry a
control byte: a CR or LF would end the command line and let a second
command be smuggled onto the control connection. */
static bool ftp_has_ctrl(const char *string)
{
const unsigned char *s = (const unsigned char *)string;
while(*s) {
if(*s < 0x20)
return TRUE;
s++;
}
return FALSE;
}
/* for USER and PASS responses */
static CURLcode ftp_state_user_resp(struct Curl_easy *data,
struct ftp_conn *ftpc,
@ -2949,16 +2963,20 @@ static CURLcode ftp_state_user_resp(struct Curl_easy *data,
result = ftp_state_loggedin(data, ftpc);
}
else if(ftpcode == 332) {
if(data->set.str[STRING_FTP_ACCOUNT]) {
result = Curl_pp_sendf(data, &ftpc->pp, "ACCT %s",
data->set.str[STRING_FTP_ACCOUNT]);
if(!result)
ftp_state(data, ftpc, FTP_ACCT);
}
else {
const char *account = data->set.str[STRING_FTP_ACCOUNT];
if(!account) {
failf(data, "ACCT requested but none available");
result = CURLE_LOGIN_DENIED;
}
else if(ftp_has_ctrl(account)) {
failf(data, "Control byte in FTP account");
result = CURLE_BAD_FUNCTION_ARGUMENT;
}
else {
result = Curl_pp_sendf(data, &ftpc->pp, "ACCT %s", account);
if(!result)
ftp_state(data, ftpc, FTP_ACCT);
}
}
else {
/* All other response codes, like:
@ -2966,14 +2984,19 @@ static CURLcode ftp_state_user_resp(struct Curl_easy *data,
530 User ... access denied
(the server denies to log the specified user) */
if(data->set.str[STRING_FTP_ALTERNATIVE_TO_USER] &&
!ftpc->ftp_trying_alternative) {
const char *alt = data->set.str[STRING_FTP_ALTERNATIVE_TO_USER];
if(alt && !ftpc->ftp_trying_alternative) {
/* Ok, USER failed. Let's try the supplied command. */
result = Curl_pp_sendf(data, &ftpc->pp, "%s",
data->set.str[STRING_FTP_ALTERNATIVE_TO_USER]);
if(!result) {
ftpc->ftp_trying_alternative = TRUE;
ftp_state(data, ftpc, FTP_USER);
if(ftp_has_ctrl(alt)) {
failf(data, "Control byte in FTP alternative-to-user command");
result = CURLE_BAD_FUNCTION_ARGUMENT;
}
else {
result = Curl_pp_sendf(data, &ftpc->pp, "%s", alt);
if(!result) {
ftpc->ftp_trying_alternative = TRUE;
ftp_state(data, ftpc, FTP_USER);
}
}
}
else {