romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-26 05:27:15 +03:00
Code Issues Projects Releases Packages Wiki Activity

urlapi: don't accept blank port number field without scheme

Browse source 
... as it makes the URL parser accept "very-long-hostname://" as a valid
host name and we don't want that. The parser now only accepts a blank
(no digits) after the colon if the URL starts with a scheme.

Reported-by: d4d on hackerone

Closes #6283
This commit is contained in:
Daniel Stenberg 2020-12-04 17:27:57 +01:00
parent 2260e0ebe6
commit abd846c374
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
4 changed files with 39 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

2
lib/urlapi-int.h
View file

@ -28,7 +28,7 @@
bool Curl_is_absolute_url(const char *url, char *scheme, size_t buflen);
#ifdef DEBUGBUILD
CURLUcode Curl_parse_port(struct Curl_URL *u, char *hostname);
CURLUcode Curl_parse_port(struct Curl_URL *u, char *hostname, bool);
#endif
#endif /* HEADER_CURL_URLAPI_INT_H */

13
lib/urlapi.c
View file

@ -497,7 +497,8 @@ static CURLUcode parse_hostname_login(struct Curl_URL *u,
return result;
}
UNITTEST CURLUcode Curl_parse_port(struct Curl_URL *u, char *hostname)
UNITTEST CURLUcode Curl_parse_port(struct Curl_URL *u, char *hostname,
bool has_scheme)
{
char *portptr = NULL;
char endbracket;
@ -542,10 +543,14 @@ UNITTEST CURLUcode Curl_parse_port(struct Curl_URL *u, char *hostname)
/* Browser behavior adaptation. If there's a colon with no digits after,
just cut off the name there which makes us ignore the colon and just
use the default port. Firefox, Chrome and Safari all do that. */
use the default port. Firefox, Chrome and Safari all do that.
Don't do it if the URL has no scheme, to make something that looks like
a scheme not work!
*/
if(!portptr[1]) {
*portptr = '\0';
return CURLUE_OK;
return has_scheme ? CURLUE_OK : CURLUE_BAD_PORT_NUMBER;
}
if(!ISDIGIT(portptr[1]))
@ -904,7 +909,7 @@ static CURLUcode seturl(const char *url, CURLU *u, unsigned int flags)
if(result)
return result;
result = Curl_parse_port(u, hostname);
result = Curl_parse_port(u, hostname, url_has_scheme);
if(result)
return result;