romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 11:33:33 +03:00
Code Issues Projects Releases Packages Wiki Activity

digest: fix OWS and escaped quote handling

Browse source 
The migration to the strparse API introduced regressions in Digest
authentication parsing where Optional Whitespace (OWS) after commas was
not skipped, and escaped quotes in values were not correctly parsed.

This change ensures whitespace is skipped before key lookups and escaped
characters are properly handled and unescaped in quoted values.

Reported-by: herdiyanitdev on hackerone
Closes #20102
This commit is contained in:
trxvorr 2025-12-28 23:58:18 +05:30 • committed by Daniel Stenberg
parent 5f5e000278
commit f81e7197c1
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
6 changed files with 124 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

7
lib/curlx/strparse.c
View file

@ -89,7 +89,7 @@ int curlx_str_untilnl(const char **linep, struct Curl_str *out,
return STRE_OK;
}
/* Get a "quoted" word. No escaping possible.
/* Get a "quoted" word. Escaped quotes are supported.
return non-zero on error */
int curlx_str_quotedword(const char **linep, struct Curl_str *out,
const size_t max)
@ -103,6 +103,11 @@ int curlx_str_quotedword(const char **linep, struct Curl_str *out,
return STRE_BEGQUOTE;
s++;
while(*s && (*s != '\"')) {
if(*s == '\\' && s[1]) {
s++;
if(++len > max)
return STRE_BIG;
}
s++;
if(++len > max)
return STRE_BIG;

2
lib/curlx/strparse.h
View file

@ -62,7 +62,7 @@ int curlx_str_until(const char **linep, struct Curl_str *out, const size_t max,
int curlx_str_untilnl(const char **linep, struct Curl_str *out,
const size_t max);
/* Get a "quoted" word. No escaping possible.
/* Get a "quoted" word. Escaped quotes are supported.
return non-zero on error */
int curlx_str_quotedword(const char **linep, struct Curl_str *out,
const size_t max);

20
lib/vauth/digest.c
View file

@ -192,6 +192,9 @@ static bool auth_digest_get_key_value(const char *chlg, const char *key,
do {
struct Curl_str data;
struct Curl_str name;
curlx_str_passblanks(&chlg);
if(!curlx_str_until(&chlg, &name, 64, '=') &&
!curlx_str_single(&chlg, '=')) {
/* this is the key, get the value, possibly quoted */
@ -204,11 +207,22 @@ static bool auth_digest_get_key_value(const char *chlg, const char *key,
if(curlx_str_cmp(&name, key)) {
/* if this is our key, return the value */
if(curlx_strlen(&data) >= buflen)
size_t len = curlx_strlen(&data);
const char *src = curlx_str(&data);
size_t i;
size_t outlen = 0;
if(len >= buflen)
/* does not fit */
return FALSE;
memcpy(buf, curlx_str(&data), curlx_strlen(&data));
buf[curlx_strlen(&data)] = 0;
for(i = 0; i < len; i++) {
if(src[i] == '\\' && i + 1 < len) {
i++; /* skip backslash */
}
buf[outlen++] = src[i];
}
buf[outlen] = 0;
return TRUE;
}
if(curlx_str_single(&chlg, ','))