romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-26 13:27:16 +03:00
Code Issues Projects Releases Packages Wiki Activity

curl_url_set: reject spaces in URLs w/o CURLU_ALLOW_SPACE

Browse source 
They were never officially allowed and slipped in only due to sloppy
parsing. Spaces (ascii 32) should be correctly encoded (to %20) before
being part of a URL.

The new flag bit CURLU_ALLOW_SPACE when a full URL is set, makes libcurl
allow spaces.

Updated test 1560 to verify.

Closes #7073
This commit is contained in:
Daniel Stenberg 2021-05-31 08:59:24 +02:00
parent 8f717b6cf0
commit b67d3ba73e
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
8 changed files with 60 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

2
tests/data/test1916
View file

@ -33,7 +33,7 @@ MQTT PUBLISH with no POSTFIELDSIZE set
lib%TESTNUMBER
</tool>
<command option="binary-trace">
"mqtt://%HOSTIP:%MQTTPORT/ "
"mqtt://%HOSTIP:%MQTTPORT/%20"
</command>
</client>

2
tests/data/test1917
View file

@ -36,7 +36,7 @@ MQTT PUBLISH with CURLOPT_POST set (no payload)
lib%TESTNUMBER
</tool>
<command option="binary-trace">
"mqtt://%HOSTIP:%MQTTPORT/ "
"mqtt://%HOSTIP:%MQTTPORT/%20"
</command>
</client>

41
tests/libtest/lib1560.c
View file

@ -129,6 +129,37 @@ struct querycase {
};
static struct testcase get_parts_list[] ={
{"https://user:password@example.net/get?this=and what", "",
CURLU_DEFAULT_SCHEME, 0, CURLUE_MALFORMED_INPUT},
{"https://user:password@example.net/ge t?this=and-what", "",
CURLU_DEFAULT_SCHEME, 0, CURLUE_MALFORMED_INPUT},
{"https://user:pass word@example.net/get?this=and-what", "",
CURLU_DEFAULT_SCHEME, 0, CURLUE_MALFORMED_INPUT},
{"https://u ser:password@example.net/get?this=and-what", "",
CURLU_DEFAULT_SCHEME, 0, CURLUE_MALFORMED_INPUT},
/* no space allowed in scheme */
{"htt ps://user:password@example.net/get?this=and-what", "",
CURLU_NON_SUPPORT_SCHEME|CURLU_ALLOW_SPACE, 0, CURLUE_MALFORMED_INPUT},
{"https://user:password@example.net/get?this=and what",
"https | user | password | [13] | example.net | [15] | /get | "
"this=and what | [17]",
CURLU_ALLOW_SPACE, 0, CURLUE_OK},
{"https://user:password@example.net/ge t?this=and-what",
"https | user | password | [13] | example.net | [15] | /ge t | "
"this=and-what | [17]",
CURLU_ALLOW_SPACE, 0, CURLUE_OK},
{"https://user:pass word@example.net/get?this=and-what",
"https | user | pass word | [13] | example.net | [15] | /get | "
"this=and-what | [17]",
CURLU_ALLOW_SPACE, 0, CURLUE_OK},
{"https://u ser:password@example.net/get?this=and-what",
"https | u ser | password | [13] | example.net | [15] | /get | "
"this=and-what | [17]",
CURLU_ALLOW_SPACE, 0, CURLUE_OK},
{"https://user:password@example.net/ge t?this=and-what",
"https | user | password | [13] | example.net | [15] | /ge%20t | "
"this=and-what | [17]",
CURLU_ALLOW_SPACE | CURLU_URLENCODE, 0, CURLUE_OK},
{"[::1]",
"http | [11] | [12] | [13] | [::1] | [15] | / | [16] | [17]",
CURLU_GUESS_SCHEME, 0, CURLUE_OK },
@ -253,11 +284,9 @@ static struct testcase get_parts_list[] ={
{"https://127abc.com",
"https | [11] | [12] | [13] | 127abc.com | [15] | / | [16] | [17]",
CURLU_DEFAULT_SCHEME, 0, CURLUE_OK},
{"https:// example.com?check",
"",
{"https:// example.com?check", "",
CURLU_DEFAULT_SCHEME, 0, CURLUE_MALFORMED_INPUT},
{"https://e x a m p l e.com?check",
"",
{"https://e x a m p l e.com?check", "",
CURLU_DEFAULT_SCHEME, 0, CURLUE_MALFORMED_INPUT},
{"https://example.com?check",
"https | [11] | [12] | [13] | example.com | [15] | / | check | [17]",
@ -385,8 +414,8 @@ static struct urltestcase get_url_list[] = {
CURLU_GUESS_SCHEME, 0, CURLUE_OK},
{"HTTP://test/", "http://test/", 0, 0, CURLUE_OK},
{"http://HO0_-st..~./", "http://HO0_-st..~./", 0, 0, CURLUE_OK},
{"http:/@example.com: 123/", "", 0, 0, CURLUE_BAD_PORT_NUMBER},
{"http:/@example.com:123 /", "", 0, 0, CURLUE_BAD_PORT_NUMBER},
{"http:/@example.com: 123/", "", 0, 0, CURLUE_MALFORMED_INPUT},
{"http:/@example.com:123 /", "", 0, 0, CURLUE_MALFORMED_INPUT},
{"http:/@example.com:123a/", "", 0, 0, CURLUE_BAD_PORT_NUMBER},
{"http://host/file\r", "", 0, 0, CURLUE_MALFORMED_INPUT},
{"http://host/file\n\x03", "", 0, 0, CURLUE_MALFORMED_INPUT},