romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 22:13:33 +03:00
Code Issues Projects Releases Packages Wiki Activity

url: do not URL decode proxy crendentials

Browse source 
The two options CURLOPT_PROXYUSERNAME and CURLOPT_PROXYPASSWORD set the
actual names as-is, not URL encoded.

Modified test 503 to use percent-encoded strings in the credential
strings that should be passed on as-is.

Reported-by: Sergey Ogryzkov
Fixes #13265
Closes #13270
This commit is contained in:
Daniel Stenberg 2024-04-03 11:32:55 +02:00
parent 29bfde9fea
commit d5e83eb745
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
4 changed files with 30 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

21
lib/url.c
View file

@ -2366,17 +2366,16 @@ static CURLcode parse_proxy_auth(struct Curl_easy *data,
data->state.aptr.proxyuser : "";
const char *proxypasswd = data->state.aptr.proxypasswd ?
data->state.aptr.proxypasswd : "";
CURLcode result = Curl_urldecode(proxyuser, 0, &conn->http_proxy.user, NULL,
REJECT_ZERO);
if(!result)
result = Curl_setstropt(&data->state.aptr.proxyuser,
conn->http_proxy.user);
if(!result)
result = Curl_urldecode(proxypasswd, 0, &conn->http_proxy.passwd,
NULL, REJECT_ZERO);
if(!result)
result = Curl_setstropt(&data->state.aptr.proxypasswd,
conn->http_proxy.passwd);
CURLcode result = CURLE_OUT_OF_MEMORY;
conn->http_proxy.user = strdup(proxyuser);
if(conn->http_proxy.user) {
conn->http_proxy.passwd = strdup(proxypasswd);
if(conn->http_proxy.passwd)
result = CURLE_OK;
else
Curl_safefree(conn->http_proxy.user);
}
return result;
}