romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-26 01:47:15 +03:00
Code Issues Projects Releases Packages Wiki Activity

digest: escape double quotes and backslashes in realm and nonce

Browse source 
change test 907 to use quote in realm to verify

Fixes #20482
Reported-by: cooldadpresident on github
Closes #20545
This commit is contained in:
Daniel Stenberg 2026-02-08 12:30:09 +01:00
parent afe9fdd1eb
commit 950c7bb174
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
2 changed files with 19 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

22
lib/vauth/digest.c
View file

@ -354,6 +354,8 @@ CURLcode Curl_auth_create_digest_md5_message(struct Curl_easy *data,
char method[] = "AUTHENTICATE";
char qop[] = DIGEST_QOP_VALUE_STRING_AUTH;
char *spn = NULL;
char *qrealm;
char *qnonce;
/* Decode the challenge message */
CURLcode result = auth_decode_digest_md5_message(chlg,
@ -467,12 +469,20 @@ CURLcode Curl_auth_create_digest_md5_message(struct Curl_easy *data,
for(i = 0; i < MD5_DIGEST_LEN; i++)
curl_msnprintf(&resp_hash_hex[2 * i], 3, "%02x", digest[i]);
/* Generate the response */
response = curl_maprintf("username=\"%s\",realm=\"%s\",nonce=\"%s\","
"cnonce=\"%s\",nc=\"%s\",digest-uri=\"%s\","
"response=%s,qop=%s",
userp, realm, nonce,
cnonce, nonceCount, spn, resp_hash_hex, qop);
/* escape double quotes and backslashes in the realm and nonce as
necessary */
qrealm = auth_digest_string_quoted(realm);
qnonce = auth_digest_string_quoted(nonce);
if(qrealm && qnonce)
/* Generate the response */
response = curl_maprintf("username=\"%s\",realm=\"%s\",nonce=\"%s\","
"cnonce=\"%s\",nc=\"%s\",digest-uri=\"%s\","
"response=%s,qop=%s",
userp, qrealm, qnonce,
cnonce, nonceCount, spn, resp_hash_hex, qop);
curlx_free(qrealm);
curlx_free(qnonce);
curlx_free(spn);
if(!response)
return CURLE_OUT_OF_MEMORY;