romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 04:23:36 +03:00
Code Issues Projects Releases Packages Wiki Activity

urlapi: handle redirect without set scheme with default-scheme

Browse source 
Verify in test 1921

Reported-by: mulan_dh on hackerone

Closes #21632
This commit is contained in:
Daniel Stenberg 2026-05-15 14:37:58 +02:00
parent 51beed175d
commit f9b9d3b141
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
5 changed files with 88 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

5
lib/urlapi.c
View file

@ -1231,9 +1231,12 @@ static CURLUcode redirect_url(const char *base, const char *relurl,
const char *cutoff = NULL;
size_t prelen;
CURLUcode uc;
/* this can get here with a NULL u->scheme only if asked to use the default
scheme, so allow fallback to that */
const char *scheme = u->scheme ? u->scheme : DEFAULT_SCHEME;
/* protsep points to the start of the hostname, after [scheme]:// */
const char *protsep = base + strlen(u->scheme) + 3;
const char *protsep = base + strlen(scheme) + 3;
DEBUGASSERT(base && relurl && u); /* all set here */
if(!base)
return CURLUE_MALFORMED_INPUT; /* should never happen */