romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-05-30 04:07:27 +03:00
Code Issues Projects Releases Packages Wiki Activity

urlapi: verify URL *decoded* hostname when set

Browse source 
It was previously wrongly verifying the input in its URL encoded format
when setting the hostname component with curl_url_set(), so it wrongly
rejected '%'.

Now it URL decodes the name appropriately before the check.

Added tests to lib1560 to verify that a fine %-code is okay and that a
bad %-code (that decodes to '%') is rejected.

Regression from 0a0c9b6dfa, shipped in 8.0.0

Fixes #14656
Reported-by: Venkat Krishna R
Closes #14657
This commit is contained in:
Daniel Stenberg 2024-08-23 10:41:26 +02:00
parent fa461b4eff
commit d1394a00ea
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
2 changed files with 25 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

18
lib/urlapi.c
View file

@ -1991,7 +1991,23 @@ nomem:
/* Skip hostname check, it is allowed to be empty. */
}
else {
if(!n || hostname_check(u, (char *)newp, n)) {
bool bad = FALSE;
if(!n)
bad = TRUE; /* empty hostname is not okay */
else if(!urlencode) {
/* if the host name part was not URL encoded here, it was set ready
URL encoded so we need to decode it to check */
size_t dlen;
char *decoded = NULL;
CURLcode result =
Curl_urldecode(newp, n, &decoded, &dlen, REJECT_CTRL);
if(result || hostname_check(u, decoded, dlen))
bad = TRUE;
free(decoded);
}
else if(hostname_check(u, (char *)newp, n))
bad = TRUE;
if(bad) {
Curl_dyn_free(&enc);
return CURLUE_BAD_HOSTNAME;
}

8
tests/libtest/lib1560.c
View file

@ -838,6 +838,14 @@ static const struct setgetcase setget_parts_list[] = {
/* !checksrc! disable SPACEBEFORECOMMA 1 */
static const struct setcase set_parts_list[] = {
{"https://example.com/",
"host=%43url.se,",
"https://%43url.se/",
0, 0, CURLUE_OK, CURLUE_OK},
{"https://example.com/",
"host=%25url.se,",
"",
0, 0, CURLUE_OK, CURLUE_BAD_HOSTNAME},
{"https://example.com/?param=value",
"query=\"\",",
"https://example.com/",