From: Dan Fandrich <dan@coneharvesters.com>
Date: Tue, 12 Oct 2010 18:22:18 +0000 (-0700)
Subject: Added section on server-supplied names to security considerations
X-Git-Tag: curl-7_21_2~4
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=2869b6ea2b96e36873f5c59660f1870387cca390;p=thirdparty%2Fcurl.git

Added section on server-supplied names to security considerations
---

diff --git a/docs/libcurl/libcurl-tutorial.3 b/docs/libcurl/libcurl-tutorial.3
index 236eba0564..72f002963a 100644
--- a/docs/libcurl/libcurl-tutorial.3
+++ b/docs/libcurl/libcurl-tutorial.3
@@ -1237,6 +1237,15 @@ are used to generate structured data. Characters like embedded carriage
 returns or ampersands could allow the user to create additional headers or
 fields that could cause malicious transactions.
 
+.IP "Server-supplied Names"
+A server can supply data which the application may, in some cases, use as
+a file name. The curl command-line tool does this with --remote-header-name,
+using the Content-disposition: header to generate a file name.  An application
+could also use CURLINFO_EFFECTIVE_URL to generate a file name from a
+server-supplied redirect URL. Special care must be taken to sanitize such
+names to avoid the possibility of a malicious server supplying one like
+"/etc/passwd", "\autoexec.bat" or even ".bashrc".
+
 .IP "Server Certificates"
 A secure application should never use the CURLOPT_SSL_VERIFYPEER option to
 disable certificate validation. There are numerous attacks that are enabled