romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-23 19:07:16 +03:00
Code Issues Projects Releases Packages Wiki Activity

libcurl: Restrict redirect schemes (follow-up)

Browse source 
- Allow FTPS on redirect.

- Update default allowed redirect protocols in documentation.

Follow-up to 6080ea0.

Ref: https://github.com/curl/curl/pull/4094

Closes https://github.com/curl/curl/pull/4115
This commit is contained in:
Jay Satiro 2019-07-16 03:35:54 -04:00
parent 647e726d78
commit e8442e4ffc
7 changed files with 18 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

9
docs/cmdline-opts/proto-redir.d
View file

@ -11,7 +11,8 @@ Example, allow only HTTP and HTTPS on redirect:
curl --proto-redir -all,http,https http://example.com
By default curl will allow all protocols on redirect except several disabled
for security reasons: Since 7.19.4 FILE and SCP are disabled, and since 7.40.0
SMB and SMBS are also disabled. Specifying \fIall\fP or \fI+all\fP enables all
protocols on redirect, including those disabled for security.
By default curl will allow HTTP, HTTPS, FTP and FTPS on redirect (7.65.2).
Older versions of curl allowed all protocols on redirect except several
disabled for security reasons: Since 7.19.4 FILE and SCP are disabled, and
since 7.40.0 SMB and SMBS are also disabled. Specifying \fIall\fP or \fI+all\fP
enables all protocols on redirect, including those disabled for security.

4
docs/libcurl/libcurl-security.3
View file

@ -97,8 +97,8 @@ Never ever switch off certificate verification.
The \fICURLOPT_FOLLOWLOCATION(3)\fP option automatically follows HTTP
redirects sent by a remote server. These redirects can refer to any kind of
URL, not just HTTP. libcurl restricts the protocols allowed to be used in
redirects for security reasons: only HTTP, HTTPS and FTP are enabled by
default. Applications may opt to restrict thus set further.
redirects for security reasons: only HTTP, HTTPS, FTP and FTPS are
enabled by default. Applications may opt to restrict that set further.
A redirect to a file: URL would cause the libcurl to read (or write) arbitrary
files from the local filesystem. If the application returns the data back to

3
docs/libcurl/opts/CURLOPT_FOLLOWLOCATION.3
View file

@ -39,7 +39,8 @@ libcurl will follow.
libcurl limits what protocols it automatically follows to. The accepted
protocols are set with \fICURLOPT_REDIR_PROTOCOLS(3)\fP. By default libcurl
will allow all protocols on redirect except those disabled for security
will allow HTTP, HTTPS, FTP and FTPS on redirect (7.65.2). Older versions of
libcurl allowed all protocols on redirect except those disabled for security
reasons: Since 7.19.4 FILE and SCP are disabled, and since 7.40.0 SMB and SMBS
are also disabled.

9
docs/libcurl/opts/CURLOPT_REDIR_PROTOCOLS.3
View file

@ -37,10 +37,11 @@ redirections.
Protocols denied by \fICURLOPT_PROTOCOLS(3)\fP are not overridden by this
option.
By default libcurl will allow all protocols on redirect except several disabled
for security reasons: Since 7.19.4 FILE and SCP are disabled, and since 7.40.0
SMB and SMBS are also disabled. \fICURLPROTO_ALL\fP enables all protocols on
redirect, including those disabled for security.
By default libcurl will allow HTTP, HTTPS, FTP and FTPS on redirect (7.65.2).
Older versions of libcurl allowed all protocols on redirect except several
disabled for security reasons: Since 7.19.4 FILE and SCP are disabled, and
since 7.40.0 SMB and SMBS are also disabled. \fICURLPROTO_ALL\fP enables all
protocols on redirect, including those disabled for security.
These are the available protocol defines:
.nf