romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-24 21:03:38 +03:00
Code Issues Projects Releases Packages Wiki Activity

tool_parsecfg: detect and error on recursive --config use

Browse source 
The config file parser now has a maximum level of inclusions allowed (5)
to detect and prevent recursive inclusions of itself leading to badness.

Bonus: clean up return code handling from the config parser.

Test 774 verifies
Closes #19168
This commit is contained in:
Daniel Stenberg 2025-10-20 22:46:56 +02:00
parent b4f57c8045
commit 9e198618de
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
10 changed files with 72 additions and 32 deletions
Download patch file Download diff file Expand all files Collapse all files

4
src/tool_parsecfg.h
View file

@ -25,7 +25,9 @@
***************************************************************************/
#include "tool_setup.h"
int parseconfig(const char *filename);
/* only allow this many levels of recursive --config use */
#define CONFIG_MAX_LEVELS 5
ParameterError parseconfig(const char *filename, int max_recursive);
bool my_get_line(FILE *fp, struct dynbuf *db, bool *error);
#endif /* HEADER_CURL_TOOL_PARSECFG_H */