Commit 178bd7db authored by Daniel Stenberg's avatar Daniel Stenberg
Browse files

url-parsing: reject CRLFs within URLs 

Bug: http://curl.haxx.se/docs/adv_20150108B.html
Reported-by: Andrey Labunets
parent f7d5ecec

lib/url.c

+7 −0
Original line number Diff line number Diff line
@@ -3842,6 +3842,13 @@ static CURLcode parseurlandfillconn(struct SessionHandle *data, 


  *prot_missing = FALSE;



  /* We might pass the entire URL into the request so we need to make sure

   * there are no bad characters in there.*/

  if(strpbrk(data->change.url, "\r\n")) {

    failf(data, "Illegal characters found in URL");

    return CURLE_URL_MALFORMAT;

  }



  /*************************************************************

   * Parse the URL.

   *