netrc: skip malformed macdef lines

When skipping macdef lines inside netrc files, ignore it completely and
do not tokenize or bail out on bad quotes.

Verify in test 1672

Follow-up to 3b43a05e00

Spotted by Codex Security
Closes #21049
This commit is contained in:
Daniel Stenberg 2026-03-21 15:23:28 +01:00
parent 6026d76fdf
commit fa13f373b2
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
3 changed files with 59 additions and 1 deletions

View file

@ -195,6 +195,9 @@ static NETRCcode netrc_get_token(const char **tokp,
if(*statep == MACDEF) {
if((*tok == '\n') || (*tok == '\r'))
*statep = NOTHING; /* end of macro definition */
*lineend = TRUE;
*tokp = tok;
return NETRC_OK;
}
if(!*tok || (*tok == '\n')) {

View file

@ -224,7 +224,7 @@ test1650 test1651 test1652 test1653 test1654 test1655 test1656 test1657 \
test1658 test1659 test1660 test1661 test1662 test1663 test1664 test1665 \
test1666 test1667 test1668 \
\
test1670 test1671 \
test1670 test1671 test1672 \
\
test1680 test1681 test1682 test1683 test1684 \
\

55
tests/data/test1672 Normal file
View file

@ -0,0 +1,55 @@
<?xml version="1.0" encoding="US-ASCII"?>
<testcase>
<info>
<keywords>
netrc
macdef
</keywords>
</info>
<reply>
<data>
HTTP/1.1 200 OK
Content-Length: 6
Content-Type: text/html
Funny-head: yesyes
12345
</data>
</reply>
# Client-side
<client>
<server>
http
</server>
<name>
netrc parser skips macdef even with broken quote
</name>
<command>
--netrc --netrc-file %LOGDIR/netrc%TESTNUMBER http://%HOSTIP:%HTTPPORT/%TESTNUMBER
</command>
<file name="%LOGDIR/netrc%TESTNUMBER" >
macdef testmacro
bin
cd "broken quote
put password.bin
quit
machine %HOSTIP login user1 password passwd1
</file>
</client>
# Verify data after the test has been "shot"
<verify>
<protocol crlf="headers">
GET /%TESTNUMBER HTTP/1.1
Host: %HOSTIP:%HTTPPORT
Authorization: Basic %b64[user1:passwd1]b64%
User-Agent: curl/%VERSION
Accept: */*
</protocol>
</verify>
</testcase>