mirror of
https://github.com/curl/curl.git
synced 2026-07-21 20:47:16 +03:00
9494750986
A CR or LF in the CURLOPT_FTP_ACCOUNT or CURLOPT_FTP_ALTERNATIVE_TO_USER string split the control-channel command line and smuggled a second FTP command. Reject a byte below 0x20 in both values before the command is built. Closes #22301
46 lines
895 B
XML
46 lines
895 B
XML
<?xml version="1.0" encoding="US-ASCII"?>
|
|
<testcase>
|
|
<info>
|
|
<keywords>
|
|
FTP
|
|
ACCT
|
|
</keywords>
|
|
</info>
|
|
# Server-side
|
|
<reply>
|
|
<servercmd>
|
|
REPLY PASS 332 please provide account name
|
|
</servercmd>
|
|
</reply>
|
|
|
|
# Client-side
|
|
<client>
|
|
<server>
|
|
ftp
|
|
</server>
|
|
<name>
|
|
FTP --ftp-account with embedded CRLF is rejected
|
|
</name>
|
|
# read the account from a config file so the raw CR LF reaches curl intact
|
|
<file name="%LOGDIR/test%TESTNUMBER.config">
|
|
ftp-account = "one\r\nDELE %TESTNUMBER"
|
|
</file>
|
|
<command>
|
|
ftp://%HOSTIP:%FTPPORT/%TESTNUMBER -K %LOGDIR/test%TESTNUMBER.config
|
|
</command>
|
|
</client>
|
|
|
|
# Verify data after the test has been "shot"
|
|
<verify>
|
|
# 43 - CURLE_BAD_FUNCTION_ARGUMENT
|
|
<errorcode>
|
|
43
|
|
</errorcode>
|
|
# the account is rejected before ACCT is built, so the injected DELE command
|
|
# must never reach the server
|
|
<protocol crlf="yes">
|
|
USER anonymous
|
|
PASS ftp@example.com
|
|
</protocol>
|
|
</verify>
|
|
</testcase>
|