romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 09:03:32 +03:00
Code Issues Projects Releases Packages Wiki Activity

ftp: reject control bytes in ACCT and alternative-to-user

Browse source 
A CR or LF in the CURLOPT_FTP_ACCOUNT or CURLOPT_FTP_ALTERNATIVE_TO_USER
string split the control-channel command line and smuggled a second FTP
command. Reject a byte below 0x20 in both values before the command is
built.

Closes #22301
This commit is contained in:
Alhuda Khan 2026-07-12 17:31:44 +05:30 • committed by Daniel Stenberg
parent c3f9ef13f6
commit 9494750986
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
4 changed files with 129 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

2
tests/data/Makefile.am
View file

@ -254,7 +254,7 @@ test2072 test2073 test2074 test2075 test2076 test2077 test2078 test2079 \
test2080 test2081 test2082 test2083 test2084 test2085 test2086 test2087 \
test2088 test2089 test2090 test2091 test2092 \
test2100 test2101 test2102 test2103 test2104 test2105 test2106 test2107 \
test2108 test2109 test2110 test2113 test2114 \
test2108 test2109 test2110 test2113 test2114 test2115 test2116 \
\
test2200 test2201 test2202 test2203 test2204 test2205 test2206 test2207 \
test2208 \

46
tests/data/test2115 Normal file
View file

@ -0,0 +1,46 @@
<?xml version="1.0" encoding="US-ASCII"?>
<testcase>
<info>
<keywords>
FTP
ACCT
</keywords>
</info>
# Server-side
<reply>
<servercmd>
REPLY PASS 332 please provide account name
</servercmd>
</reply>
# Client-side
<client>
<server>
ftp
</server>
<name>
FTP --ftp-account with embedded CRLF is rejected
</name>
# read the account from a config file so the raw CR LF reaches curl intact
<file name="%LOGDIR/test%TESTNUMBER.config">
ftp-account = "one\r\nDELE %TESTNUMBER"
</file>
<command>
ftp://%HOSTIP:%FTPPORT/%TESTNUMBER -K %LOGDIR/test%TESTNUMBER.config
</command>
</client>
# Verify data after the test has been "shot"
<verify>
# 43 - CURLE_BAD_FUNCTION_ARGUMENT
<errorcode>
43
</errorcode>
# the account is rejected before ACCT is built, so the injected DELE command
# must never reach the server
<protocol crlf="yes">
USER anonymous
PASS ftp@example.com
</protocol>
</verify>
</testcase>

45
tests/data/test2116 Normal file
View file

@ -0,0 +1,45 @@
<?xml version="1.0" encoding="US-ASCII"?>
<testcase>
<info>
<keywords>
FTP
--ftp-alternative-to-user
</keywords>
</info>
# Server-side
<reply>
<servercmd>
REPLY USER 530 go away
</servercmd>
</reply>
# Client-side
<client>
<server>
ftp
</server>
<name>
FTP --ftp-alternative-to-user with embedded CRLF is rejected
</name>
# read the command from a config file so the raw CR LF reaches curl intact
<file name="%LOGDIR/test%TESTNUMBER.config">
ftp-alternative-to-user = "USER me\r\nDELE %TESTNUMBER"
</file>
<command>
ftp://%HOSTIP:%FTPPORT/%TESTNUMBER/ -K %LOGDIR/test%TESTNUMBER.config
</command>
</client>
# Verify data after the test has been "shot"
<verify>
# 43 - CURLE_BAD_FUNCTION_ARGUMENT
<errorcode>
43
</errorcode>
# the replacement command is rejected before it is sent, so the injected DELE
# command must never reach the server
<protocol crlf="yes">
USER anonymous
</protocol>
</verify>
</testcase>