romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-24 11:47:16 +03:00
Code Issues Projects Releases Packages Wiki Activity

mime: reject CR and LF in mail part name and filename

Browse source 
Closes #22247
This commit is contained in:
Alhuda Khan 2026-07-02 16:23:36 +05:30 • committed by Daniel Stenberg
parent 02214d98f7
commit c3f9ef13f6
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
5 changed files with 165 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

10
lib/mime.c
View file

@ -1708,6 +1708,16 @@ static CURLcode add_content_disposition(struct Curl_easy *data,
CURLcode result = CURLE_OK;
char *name = NULL;
char *filename = NULL;
/* The mail (and legacy mime_formescape) strategy quotes the name and
filename with a backslash and has no in-band way to represent a CR or
LF, so one embedded in the value would split the generated header. The
form strategy percent-encodes CR/LF (see escape_string) and is safe. */
bool backslash = (strategy == MIMESTRATEGY_MAIL) ||
(data && data->set.mime_formescape);
if(backslash &&
((part->name && part->name[strcspn(part->name, "\r\n")]) ||
(part->filename && part->filename[strcspn(part->filename, "\r\n")])))
return CURLE_BAD_FUNCTION_ARGUMENT;
if(part->name) {
name = escape_string(data, part->name, strategy);