From 0a0c9b6dfa0de4a4cdfe3ac7f5f28f807d9b297f Mon Sep 17 00:00:00 2001 From: Daniel Stenberg Date: Wed, 8 Mar 2023 13:49:09 +0100 Subject: [PATCH] urlapi: '%' is illegal in host names Update test 1560 to verify Ref: #10708 Closes #10711 --- lib/urlapi.c | 2 +- tests/libtest/lib1560.c | 6 ++---- 2 files changed, 3 insertions(+), 5 deletions(-) diff --git a/lib/urlapi.c b/lib/urlapi.c index d078a49fc5..c2caafbf0f 100644 --- a/lib/urlapi.c +++ b/lib/urlapi.c @@ -629,7 +629,7 @@ static CURLUcode hostname_check(struct Curl_URL *u, char *hostname, } else { /* letters from the second string are not ok */ - len = strcspn(hostname, " \r\n\t/:#?!@{}[]\\$\'\"^`*<>=;,+&()"); + len = strcspn(hostname, " \r\n\t/:#?!@{}[]\\$\'\"^`*<>=;,+&()%"); if(hlen != len) /* hostname with bad content */ return CURLUE_BAD_HOSTNAME; diff --git a/tests/libtest/lib1560.c b/tests/libtest/lib1560.c index de9998d971..81f8f740c8 100644 --- a/tests/libtest/lib1560.c +++ b/tests/libtest/lib1560.c @@ -141,6 +141,7 @@ struct clearurlcase { }; static const struct testcase get_parts_list[] ={ + {"https://test%test", "", 0, 0, CURLUE_BAD_HOSTNAME}, {"https://example.com%252f%40@example.net", "https | example.com%2f@ | [12] | [13] | example.net | [15] | / " "| [16] | [17]", @@ -509,13 +510,10 @@ static const struct urltestcase get_url_list[] = { {"http://example.com%3a127.0.0.1/", "", 0, 0, CURLUE_BAD_HOSTNAME}, {"http://example.com%09127.0.0.1/", "", 0, 0, CURLUE_BAD_HOSTNAME}, {"http://example.com%2F127.0.0.1/", "", 0, 0, CURLUE_BAD_HOSTNAME}, - {"https://%this", "https://%25this/", 0, 0, CURLUE_OK}, - {"https://h%c", "https://h%25c/", 0, 0, CURLUE_OK}, - {"https://%%%%%%", "https://%25%25%25%25%25%25/", 0, 0, CURLUE_OK}, {"https://%41", "https://A/", 0, 0, CURLUE_OK}, {"https://%20", "", 0, 0, CURLUE_BAD_HOSTNAME}, {"https://%41%0d", "", 0, 0, CURLUE_BAD_HOSTNAME}, - {"https://%25", "https://%25/", 0, 0, CURLUE_OK}, + {"https://%25", "", 0, 0, CURLUE_BAD_HOSTNAME}, {"https://_%c0_", "https://_\xC0_/", 0, 0, CURLUE_OK}, {"https://_%c0_", "https://_%C0_/", 0, CURLU_URLENCODE, CURLUE_OK}, -- 2.47.3