← Commit list

f4caaa2354

Daniel Stenberg
Daniel Stenberg
2026-09-14
SUCCESS Duration: 400s

Subject

urlapi: reject more junk from the zone id

Binary

No binary (build failed)

Architecture & Compiler Flags

Architecture: x86_64-linux-gnu Compiler: gcc (Ubuntu 11.4.0-1ubuntu1~22.04.3) 11.4.0

—

Build Log

(log yok)

Commit Diff GitHub →

lib/urlapi.c +16 -16tests/libtest/lib1560.c +3 -0
lib/urlapi.c+16 -16
@@ -440,6 +440,20 @@ UNITTEST CURLUcode parse_port(struct Curl_URL *u, struct dynbuf *host,
return CURLUE_OK;
}
+/* characters not allowed in hostnames:
+ " \r\n\t/:#?!@{}[]\\$\'\"^`*<>=;,+&()%|" */
+
+static const bool invalid_host_char[256] = {
+ 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, /* 0x00-0x0F */
+ 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, /* 0x10-0x1F */
+ 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 0, 0, 1, /* 0x20-0x2F */
+ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 1, 1, /* 0x30-0x3F */
+ 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 0x40-0x4F */
+ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 0, /* 0x50-0x5F */
+ 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 0x60-0x6F */
+ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 0, 1 /* 0x70-0x7F */
+};
+
/* This function assumes 'hostname' now starts with [. It trims 'hostname' in
* place and it sets u->zoneid if present.
*
@@ -470,8 +484,8 @@ UNITTEST CURLUcode ipv6_parse(struct Curl_URL *u, char *hostname,
/* pass '25' if present and is a URL encoded percent sign */
if(!strncmp(h, "25", 2) && h[2] && (h[2] != ']'))
h += 2;
- while(*h && (*h != ']') && (i < (MAX_ZONEID_LEN - 1)) &&
- (*h != ' '))
+ while(!invalid_host_char[(unsigned char)*h] && (*h != ']') &&
+ (i < (MAX_ZONEID_LEN - 1)))
zoneid[i++] = *h++;
if(!i || (']' != *h))
return CURLUE_BAD_IPV6;
@@ -502,20 +516,6 @@ UNITTEST CURLUcode ipv6_parse(struct Curl_URL *u, char *hostname,
return CURLUE_OK;
}
-/* characters not allowed in hostnames:
- " \r\n\t/:#?!@{}[]\\$\'\"^`*<>=;,+&()%|" */
-
-static const bool invalid_host_char[256] = {
- 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, /* 0x00-0x0F */
- 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, /* 0x10-0x1F */
- 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 0, 0, 1, /* 0x20-0x2F */
- 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 1, 1, /* 0x30-0x3F */
- 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 0x40-0x4F */
- 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 0, /* 0x50-0x5F */
- 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 0x60-0x6F */
- 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 0, 1 /* 0x70-0x7F */
-};
-
/* the input is a confirmed hostname, never an IPv6 address */
static CURLUcode hostname_check(char *hostname, size_t hlen)
{
tests/libtest/lib1560.c+3 -0
@@ -893,6 +893,9 @@ static const struct urltestcase get_url_list[] = {
{"https://[::%25fa keit]:80/moo",
"",
0, 0, CURLUE_BAD_IPV6},
+ {"https://[::%25fa%\x7fkeit]:80/moo",
+ "",
+ 0, 0, CURLUE_BAD_IPV6},
{"https://[::%25fa keit]:80/moo",
"",
CURLU_ALLOW_SPACE, 0, CURLUE_BAD_IPV6},