romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 22:53:38 +03:00
Code Issues Projects Releases Packages Wiki Activity

urlapi: verify the IPv6 numerical address

Browse source 
It needs to parse correctly. Otherwise it could be tricked into letting
through a-f using host names that libcurl would then resolve. Like
'[ab.be]'.

Reported-by: Thomas Vegas
Closes #4315
This commit is contained in:
Daniel Stenberg 2019-09-04 23:49:30 +02:00
parent ffe34b7b59
commit eab3c580f9
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
2 changed files with 17 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

4
tests/libtest/lib1560.c
View file

@ -140,6 +140,10 @@ static struct testcase get_parts_list[] ={
"file | [11] | [12] | [13] | [14] | [15] | C:\\programs\\foo | [16] | [17]",
CURLU_DEFAULT_SCHEME, 0, CURLUE_OK},
#endif
{"http://[ab.be:1]/x", "",
CURLU_DEFAULT_SCHEME, 0, CURLUE_MALFORMED_INPUT},
{"http://[ab.be]/x", "",
CURLU_DEFAULT_SCHEME, 0, CURLUE_MALFORMED_INPUT},
/* URL without host name */
{"http://a:b@/x", "",
CURLU_DEFAULT_SCHEME, 0, CURLUE_NO_HOST},