url-parsing: reject CRLFs within URLs

Bug: http://curl.haxx.se/docs/adv_20150108B.html
Reported-by: Andrey Labunets

diff --git a/lib/url.c b/lib/url.c
index 788f04849d64923de319f9c055a53f2ab036d4f5..d3bb5e0116e502dfe126333cb805cd8a4499dcc7 100644 (file)
--- a/lib/url.c
+++ b/lib/url.c
@@ -3842,6 +3842,13 @@ static CURLcode parseurlandfillconn(struct SessionHandle *data,
 
   *prot_missing = FALSE;
 
+  /* We might pass the entire URL into the request so we need to make sure
+   * there are no bad characters in there.*/
+  if(strpbrk(data->change.url, "\r\n")) {
+    failf(data, "Illegal characters found in URL");
+    return CURLE_URL_MALFORMAT;
+  }
+
   /*************************************************************
    * Parse the URL.
    *