From eb0167ff7d31d3a5e1f01e8b05e25b1bf94bb2a7 Mon Sep 17 00:00:00 2001 From: Daniel Stenberg Date: Tue, 27 Sep 2022 17:48:08 +0200 Subject: [PATCH] urlapi: reject more bad characters from the host name field Extended test 1560 to verify Report from the ongoing source code audit by Trail of Bits. Closes #9608 --- lib/urlapi.c | 2 +- tests/libtest/lib1560.c | 20 ++++++++++++++++++++ 2 files changed, 21 insertions(+), 1 deletion(-) diff --git a/lib/urlapi.c b/lib/urlapi.c index c28960ac10..b3c91a085d 100644 --- a/lib/urlapi.c +++ b/lib/urlapi.c @@ -637,7 +637,7 @@ static CURLUcode hostname_check(struct Curl_URL *u, char *hostname, } else { /* letters from the second string are not ok */ - len = strcspn(hostname, " \r\n\t/:#?!@"); + len = strcspn(hostname, " \r\n\t/:#?!@{}[]\\$\'\"^`*<>=;,"); if(hlen != len) /* hostname with bad content */ return CURLUE_BAD_HOSTNAME; diff --git a/tests/libtest/lib1560.c b/tests/libtest/lib1560.c index e4acc3d742..4016266bfc 100644 --- a/tests/libtest/lib1560.c +++ b/tests/libtest/lib1560.c @@ -138,6 +138,26 @@ struct clearurlcase { }; static const struct testcase get_parts_list[] ={ + {"https://exam{}[]ple.net", "", 0, 0, CURLUE_BAD_HOSTNAME}, + {"https://exam{ple.net", "", 0, 0, CURLUE_BAD_HOSTNAME}, + {"https://exam}ple.net", "", 0, 0, CURLUE_BAD_HOSTNAME}, + {"https://exam]ple.net", "", 0, 0, CURLUE_BAD_HOSTNAME}, + {"https://exam\\ple.net", "", 0, 0, CURLUE_BAD_HOSTNAME}, + {"https://exam$ple.net", "", 0, 0, CURLUE_BAD_HOSTNAME}, + {"https://exam'ple.net", "", 0, 0, CURLUE_BAD_HOSTNAME}, + {"https://exam\"ple.net", "", 0, 0, CURLUE_BAD_HOSTNAME}, + {"https://exam^ple.net", "", 0, 0, CURLUE_BAD_HOSTNAME}, + {"https://exam`ple.net", "", 0, 0, CURLUE_BAD_HOSTNAME}, + {"https://exam*ple.net", "", 0, 0, CURLUE_BAD_HOSTNAME}, + {"https://example.net", "", 0, 0, CURLUE_BAD_HOSTNAME}, + {"https://exam=ple.net", "", 0, 0, CURLUE_BAD_HOSTNAME}, + {"https://exam;ple.net", "", 0, 0, CURLUE_BAD_HOSTNAME}, + {"https://example,net", "", 0, 0, CURLUE_BAD_HOSTNAME}, + {"https://example.net/}", + "https | [11] | [12] | [13] | example.net | [15] | /} | [16] | [17]", + 0, 0, CURLUE_OK}, + /* blank user is blank */ {"https://:password@example.net", "https | | password | [13] | example.net | [15] | / | [16] | [17]", -- 2.47.3