romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-06-02 14:54:37 +03:00
Code Issues Projects Releases Packages Wiki Activity

urlapi: forbid '|' in host

Browse source 
Closes #21762
This commit is contained in:
tiymat 2026-05-26 22:35:27 -02:30 • committed by Daniel Stenberg
parent efdf733bae
commit a8e6f90a69
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
2 changed files with 2 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
lib/urlapi.c
View file

@ -471,7 +471,7 @@ static CURLUcode hostname_check(struct Curl_URL *u, char *hostname,
return ipv6_parse(u, hostname, hlen);
else {
/* letters from the second string are not ok */
len = strcspn(hostname, " \r\n\t/:#?!@{}[]\\$\'\"^`*<>=;,+&()%");
len = strcspn(hostname, " \r\n\t/:#?!@{}[]\\$\'\"^`*<>=;,+&()%|");
if(hlen != len)
/* hostname with bad content */
return CURLUE_BAD_HOSTNAME;

1
tests/libtest/lib1560.c
View file

@ -326,6 +326,7 @@ static const struct testcase get_parts_list[] = {
{"https://user@example.net?he l lo",
"https | user | [12] | [13] | example.net | [15] | / | he l lo | [17]",
CURLU_ALLOW_SPACE, 0, CURLUE_OK},
{"https://exam|ple.net", "", 0, 0, CURLUE_BAD_HOSTNAME},
{"https://exam{}[]ple.net", "", 0, 0, CURLUE_BAD_HOSTNAME},
{"https://exam{ple.net", "", 0, 0, CURLUE_BAD_HOSTNAME},
{"https://exam}ple.net", "", 0, 0, CURLUE_BAD_HOSTNAME},