romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-24 15:53:32 +03:00
Code Issues Projects Releases Packages Wiki Activity

urlapi: reject more bad letters from the host name: &+()

Browse source 
Follow-up from eb0167ff7d

Extend test 1560 to verify

Closes #10096
This commit is contained in:
Daniel Stenberg 2022-12-14 23:41:08 +01:00
parent b740f152a8
commit c20b35ddae
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
2 changed files with 9 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

2
lib/urlapi.c
View file

@ -636,7 +636,7 @@ static CURLUcode hostname_check(struct Curl_URL *u, char *hostname,
}
else {
/* letters from the second string are not ok */
len = strcspn(hostname, " \r\n\t/:#?!@{}[]\\$\'\"^`*<>=;,");
len = strcspn(hostname, " \r\n\t/:#?!@{}[]\\$\'\"^`*<>=;,+&()");
if(hlen != len)
/* hostname with bad content */
return CURLUE_BAD_HOSTNAME;