romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 12:43:37 +03:00
Code Issues Projects Releases Packages Wiki Activity

xattr: strip credentials from any URL that is stored

Browse source 
Both user and password are cleared uncondtitionally.

Added unit test 1621 to verify.

Fixes #3423
Closes #3433
This commit is contained in:
Daniel Stenberg 2019-01-02 20:18:27 +01:00
parent afeb8d9902
commit 98e6629154
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
5 changed files with 177 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

63
src/tool_xattr.c
View file

@ -5,7 +5,7 @@
* | (__| |_| | _ <| |___
* \___|\___/|_| \_\_____|
*
* Copyright (C) 1998 - 2014, Daniel Stenberg, <daniel@haxx.se>, et al.
* Copyright (C) 1998 - 2019, Daniel Stenberg, <daniel@haxx.se>, et al.
*
* This software is licensed as described in the file COPYING, which
* you should have received as part of this distribution. The terms
@ -49,6 +49,46 @@ static const struct xattr_mapping {
{ NULL, CURLINFO_NONE } /* last element, abort loop here */
};
/* returns TRUE if a new URL is returned, that then needs to be freed */
/* @unittest: 1621 */
#ifdef UNITTESTS
bool stripcredentials(char **url);
#else
static
#endif
bool stripcredentials(char **url)
{
CURLU *u;
CURLUcode uc;
char *nurl;
u = curl_url();
if(u) {
uc = curl_url_set(u, CURLUPART_URL, *url, 0);
if(uc)
goto error;
uc = curl_url_set(u, CURLUPART_USER, NULL, 0);
if(uc)
goto error;
uc = curl_url_set(u, CURLUPART_PASSWORD, NULL, 0);
if(uc)
goto error;
uc = curl_url_get(u, CURLUPART_URL, &nurl, 0);
if(uc)
goto error;
curl_url_cleanup(u);
*url = nurl;
return TRUE;
}
error:
curl_url_cleanup(u);
return FALSE;
}
/* store metadata from the curl request alongside the downloaded
* file using extended attributes
*/
@ -62,17 +102,24 @@ int fwrite_xattr(CURL *curl, int fd)
char *value = NULL;
CURLcode result = curl_easy_getinfo(curl, mappings[i].info, &value);
if(!result && value) {
bool freeptr = FALSE;
if(CURLINFO_EFFECTIVE_URL == mappings[i].info)
freeptr = stripcredentials(&value);
if(value) {
#ifdef HAVE_FSETXATTR_6
err = fsetxattr(fd, mappings[i].attr, value, strlen(value), 0, 0);
err = fsetxattr(fd, mappings[i].attr, value, strlen(value), 0, 0);
#elif defined(HAVE_FSETXATTR_5)
err = fsetxattr(fd, mappings[i].attr, value, strlen(value), 0);
err = fsetxattr(fd, mappings[i].attr, value, strlen(value), 0);
#elif defined(__FreeBSD_version)
err = extattr_set_fd(fd, EXTATTR_NAMESPACE_USER, mappings[i].attr, value,
strlen(value));
/* FreeBSD's extattr_set_fd returns the length of the extended attribute
*/
err = err < 0 ? err : 0;
err = extattr_set_fd(fd, EXTATTR_NAMESPACE_USER, mappings[i].attr,
value, strlen(value));
/* FreeBSD's extattr_set_fd returns the length of the extended
attribute */
err = err < 0 ? err : 0;
#endif
if(freeptr)
curl_free(value);
}
}
i++;
}