romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-10 11:07:16 +03:00
Code Issues Projects Releases Packages Wiki Activity

mqtt: reject control bytes in the topic

Browse source 
Closes #22112
This commit is contained in:
alhudz 2026-06-19 22:15:20 +05:30 • committed by Daniel Stenberg
parent c10a7aa259
commit f746780a1e
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
3 changed files with 52 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
lib/mqtt.c
View file

@ -438,7 +438,7 @@ static CURLcode mqtt_get_topic(struct Curl_easy *data,
const char *path = data->state.up.path;
CURLcode result = CURLE_URL_MALFORMAT;
if(strlen(path) > 1) {
result = Curl_urldecode(path + 1, 0, topic, topiclen, REJECT_NADA);
result = Curl_urldecode(path + 1, 0, topic, topiclen, REJECT_CTRL);
if(!result && (*topiclen > 0xffff)) {
failf(data, "Too long MQTT topic");
result = CURLE_URL_MALFORMAT;

2
tests/data/Makefile.am
View file

@ -254,7 +254,7 @@ test2072 test2073 test2074 test2075 test2076 test2077 test2078 test2079 \
test2080 test2081 test2082 test2083 test2084 test2085 test2086 test2087 \
test2088 test2089 test2090 test2091 test2092 \
test2100 test2101 test2102 test2103 test2104 test2105 test2106 test2107 \
test2108 \
test2108 test2109 \
\
test2200 test2201 test2202 test2203 test2204 test2205 test2206 test2207 \
test2208 \

50
tests/data/test2109 Normal file
View file

@ -0,0 +1,50 @@
<?xml version="1.0" encoding="US-ASCII"?>
<testcase>
<info>
<keywords>
MQTT
MQTT SUBSCRIBE
</keywords>
</info>
# Server-side
<reply>
<data nocheck="yes">
hello
</data>
</reply>
# Client-side
<client>
<features>
mqtt
</features>
<server>
mqtt
</server>
<name>
MQTT rejects a control byte in the topic
</name>
<command option="binary-trace">
mqtt://%HOSTIP:%MQTTPORT/aa%00bb
</command>
</client>
# Verify data after the test has been "shot"
<verify>
# These are hexadecimal protocol dumps from the client
# Strip out the random part of the client id from the CONNECT message
# before comparison
<strippart>
s/^(.* 00044d5154540402003c000c6375726c).*/$1/
</strippart>
# the topic is decoded and the embedded nul rejected before SUBSCRIBE is sent
<protocol>
client CONNECT 18 00044d5154540402003c000c6375726c
server CONNACK 2 20020000
</protocol>
<errorcode>
3
</errorcode>
</verify>
</testcase>