6ae66b31d9
Daniel Stenberg
2026-09-14
Subject
urlapi: reject spaces and control characters in zone id
Binary
No binary (build failed)
Architecture & Compiler Flags
—
Build Log
(log yok)
Commit Diff GitHub →
lib/urlapi.c+2 -1
| @@ -470,7 +470,8 @@ UNITTEST CURLUcode ipv6_parse(struct Curl_URL *u, char *hostname, | |
| /* pass '25' if present and is a URL encoded percent sign */ | |
| if(!strncmp(h, "25", 2) && h[2] && (h[2] != ']')) | |
| h += 2; | |
| - | while(*h && (*h != ']') && (i < (MAX_ZONEID_LEN - 1))) |
| + | while(*h && (*h != ']') && (i < (MAX_ZONEID_LEN - 1)) && |
| + | (*h != ' ')) |
| zoneid[i++] = *h++; | |
| if(!i || (']' != *h)) | |
| return CURLUE_BAD_IPV6; | |
tests/libtest/lib1560.c+9 -0
| @@ -890,6 +890,15 @@ static const struct urltestcase get_url_list[] = { | |
| {"https://[::%25fakeit];80/moo", | |
| "", | |
| 0, 0, CURLUE_BAD_PORT_NUMBER}, | |
| + | {"https://[::%25fa keit]:80/moo", |
| + | "", |
| + | 0, 0, CURLUE_BAD_IPV6}, |
| + | {"https://[::%25fa keit]:80/moo", |
| + | "", |
| + | CURLU_ALLOW_SPACE, 0, CURLUE_BAD_IPV6}, |
| + | {"https://[::%25fake\tit]:80/moo", |
| + | "", |
| + | 0, 0, CURLUE_BAD_HOSTNAME}, |
| {"https://[fe80::20c:29ff:fe9c:409b]-80/moo", | |
| "", | |
| 0, 0, CURLUE_BAD_PORT_NUMBER}, | |