romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-05 19:46:18 +03:00
Code Issues Projects Releases Packages Wiki Activity

url: reject ASCII control characters and space in host names

Browse source 
Host names like "127.0.0.1 moo" would otherwise be accepted by some
getaddrinfo() implementations.

Updated test 1034 and 1035 accordingly.

Fixes #2073
Closes #2092
This commit is contained in:
Daniel Stenberg 2017-11-17 16:48:37 +01:00
parent 9554c3c6e5
commit fa939220df
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
3 changed files with 47 additions and 48 deletions
Download patch file Download diff file Expand all files Collapse all files

49
lib/url.c
View file

@ -1687,7 +1687,7 @@ static bool is_ASCII_name(const char *hostname)
/*
* Perform any necessary IDN conversion of hostname
*/
static void fix_hostname(struct connectdata *conn, struct hostname *host)
static CURLcode fix_hostname(struct connectdata *conn, struct hostname *host)
{
size_t len;
struct Curl_easy *data = conn->data;
@ -1727,9 +1727,11 @@ static void fix_hostname(struct connectdata *conn, struct hostname *host)
/* change the name pointer to point to the encoded hostname */
host->name = host->encalloc;
}
else
infof(data, "Failed to convert %s to ACE; %s\n", host->name,
else {
failf(data, "Failed to convert %s to ACE; %s\n", host->name,
idn2_strerror(rc));
return CURLE_URL_MALFORMAT;
}
}
#elif defined(USE_WIN32_IDN)
char *ace_hostname = NULL;
@ -1739,12 +1741,24 @@ static void fix_hostname(struct connectdata *conn, struct hostname *host)
/* change the name pointer to point to the encoded hostname */
host->name = host->encalloc;
}
else
infof(data, "Failed to convert %s to ACE;\n", host->name);
else {
failf(data, "Failed to convert %s to ACE;\n", host->name);
return CURLE_URL_MALFORMAT;
}
#else
infof(data, "IDN support not present, can't parse Unicode domains\n");
#endif
}
{
char *hostp;
for(hostp = host->name; *hostp; hostp++) {
if(*hostp <= 32) {
failf(data, "Host name '%s' contains bad letter", host->name);
return CURLE_URL_MALFORMAT;
}
}
}
return CURLE_OK;
}
/*
@ -4178,13 +4192,24 @@ static CURLcode create_conn(struct Curl_easy *data,
/*************************************************************
* IDN-fix the hostnames
*************************************************************/
fix_hostname(conn, &conn->host);
if(conn->bits.conn_to_host)
fix_hostname(conn, &conn->conn_to_host);
if(conn->bits.httpproxy)
fix_hostname(conn, &conn->http_proxy.host);
if(conn->bits.socksproxy)
fix_hostname(conn, &conn->socks_proxy.host);
result = fix_hostname(conn, &conn->host);
if(result)
goto out;
if(conn->bits.conn_to_host) {
result = fix_hostname(conn, &conn->conn_to_host);
if(result)
goto out;
}
if(conn->bits.httpproxy) {
result = fix_hostname(conn, &conn->http_proxy.host);
if(result)
goto out;
}
if(conn->bits.socksproxy) {
result = fix_hostname(conn, &conn->socks_proxy.host);
if(result)
goto out;
}
/*************************************************************
* Check whether the host and the "connect to host" are equal.