gopher: reject CR and LF in the selector

Verifed in test 1609

Closes #22116

diff --git a/lib/gopher.c b/lib/gopher.c
index 039697466b73a9f15ec311af207a2e5b82815be1..39f4bc0efc625b0b7d6640fcd5d36e4a059fbb19 100644 (file)
--- a/lib/gopher.c
+++ b/lib/gopher.c
@@ -103,6 +103,16 @@ static CURLcode gopher_do(struct Curl_easy *data, bool *done)
     if(result)
       return result;
     buf = buf_alloc;
+
+    /* A decoded CR or LF would terminate the single-line gopher request and
+       let a crafted URL smuggle additional bytes onto the wire. REJECT_ZERO
+       only blocks NUL; reject CR and LF here too. A TAB is left alone as it
+       is the legitimate gopher type-7 selector/search separator. */
+    if(memchr(buf, '\r', buf_len) || memchr(buf, '\n', buf_len)) {
+      curlx_free(buf_alloc);
+      failf(data, "Bad gopher selector, CR or LF not allowed");
+      return CURLE_URL_MALFORMAT;
+    }
   }
 
   for(; buf_len;) {

diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am
index 2edc771070d13fb07403dcf41f10969a1580aead..a8a3b96e610bea0cdb91a738a09300ec32203f33 100644 (file)
--- a/tests/data/Makefile.am
+++ b/tests/data/Makefile.am
@@ -211,7 +211,7 @@ test1573 test1574 test1575 test1576 test1577 test1578 test1579 test1580 \
 test1581 test1582 test1583 test1584 test1585 test1586 test1587 test1588 \
 test1589 test1590 test1591 test1592 test1593 test1594 test1595 test1596 \
 test1597 test1598 test1599 test1600 test1601 test1602 test1603 test1604 \
-test1605 test1606 test1607 test1608          test1610 test1611 test1612 \
+test1605 test1606 test1607 test1608 test1609 test1610 test1611 test1612 \
 test1613 test1614 test1615 test1616 test1617 test1618 test1619 test1620 \
 test1621 test1622 test1623 test1624 test1625 test1626 test1627 test1628 \
 test1629 test1630 test1631 test1632 test1633 test1634 test1635 test1636 \

diff --git a/tests/data/test1609 b/tests/data/test1609
new file mode 100644 (file)
index 0000000..14058b1
--- /dev/null
+++ b/tests/data/test1609
@@ -0,0 +1,38 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+GOPHER
+CRLF-in-URL
+</keywords>
+</info>
+
+# Server-side
+<reply>
+</reply>
+
+# Client-side
+<client>
+<server>
+gopher
+</server>
+<name>
+Gopher with URL-encoded CR LF in the selector
+</name>
+<command>
+gopher://%HOSTIP:%GOPHERPORT/1/sel%0d%0aINJECT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+# 3 - CURLE_URL_MALFORMAT
+<errorcode>
+3
+</errorcode>
+# nothing must reach the server, the selector is rejected before any send
+<protocol nonewline="yes">
+
+</protocol>
+</verify>
+</testcase>