CURLOPT_PATH_AS_IS: added (5d232792) · Commits · CYBER - Cyber Security / TS 103 523 MSP / TLMSP / TLMSP curl

docs/curl.1

+6 −0

Original line number	Diff line number	Diff line
		@@ -1235,6 +1235,12 @@ available.
		(SSL/SSH) Passphrase for the private key

		If this option is used several times, the last one will be used.
		.IP "--path-as-is"
		Tell curl to not handle sequences of /../ or /./ in the given URL
		path. Normally curl will squash or merge them according to standards but with
		this option set you tell it not to do that.

		(Added in 7.42.0)
		.IP "--post301"
		(HTTP) Tells curl to respect RFC 2616/10.3.2 and not convert POST requests
		into GET requests when following a 301 redirection. The non-RFC behaviour is

docs/libcurl/opts/CURLOPT_PATH_AS_IS.3

0 → 100644

+63 −0

Original line number	Diff line number	Diff line
		.\" **************************************************************************
		.\" * _ _ ____ _
		.\" * Project ___\| \| \| \| _ \\| \|
		.\" * / __\| \| \| \| \|_) \| \|
		.\" * \| (__\| \|_\| \| _ <\| \|___
		.\" * \___\|\___/\|_\| \_\_____\|
		.\" *
		.\" * Copyright (C) 1998 - 2015, Daniel Stenberg, <daniel@haxx.se>, et al.
		.\" *
		.\" * This software is licensed as described in the file COPYING, which
		.\" * you should have received as part of this distribution. The terms
		.\" * are also available at http://curl.haxx.se/docs/copyright.html.
		.\" *
		.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
		.\" * copies of the Software, and permit persons to whom the Software is
		.\" * furnished to do so, under the terms of the COPYING file.
		.\" *
		.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
		.\" * KIND, either express or implied.
		.\" *
		.\" **************************************************************************
		.\"
		.TH CURLOPT_PATH_AS_IS 3 "17 Jun 2014" "libcurl 7.42.0" "curl_easy_setopt options"
		.SH NAME
		CURLOPT_PATH_AS_IS \- do not handle dot dot sequences
		.SH SYNOPSIS
		#include <curl/curl.h>

		CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PATH_AS_IS, leaveit);
		.SH DESCRIPTION
		By setting the long \fIleavit\fP to 1, to explicitly tell libcurl to not alter
		the given path before passing it on to the server.

		This tells libcurl to NOT squash sequences of "/../" or "/./" that may exist
		in the URL's path part and that is supposed to be removed according to RFC
		3986 section 5.2.4.

		Some server implementations are known to (erroneously) require the dot dot
		sequences to remain in the path and some clients want to pass these on in
		order to try out server implementations.

		By default libcurl will merge such sequences before using the path.
		.SH DEFAULT
		0
		.SH PROTOCOLS
		All
		.SH EXAMPLE
		.nf
		CURL *curl = curl_easy_init();
		if(curl) {
		curl_easy_setopt(curl, CURLOPT_URL, "http://example.com/../../etc/password");

		curl_easy_setopt(curl, CURLOPT_PATH_AS_IS, 1L);

		curl_easy_perform(curl);
		}
		.fi
		.SH AVAILABILITY
		Aded in 7.42.0
		.SH RETURN VALUE
		Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
		.SH "SEE ALSO"
		.BR CURLOPT_STDERR "(3), " CURLOPT_DEBUGFUNCTION "(3), "

docs/libcurl/opts/Makefile.am

+13 −13

Original line number	Diff line number	Diff line
		@@ -90,15 +90,15 @@ man_MANS = CURLOPT_ACCEPT_ENCODING.3 CURLOPT_ACCEPTTIMEOUT_MS.3 \
		CURLOPT_SSLCERT.3 CURLOPT_SSLCERTTYPE.3 CURLOPT_SSL_CIPHER_LIST.3 \
		CURLOPT_SSL_CTX_DATA.3 CURLOPT_SSL_CTX_FUNCTION.3 \
		CURLOPT_SSL_ENABLE_ALPN.3 CURLOPT_SSL_ENABLE_NPN.3 CURLOPT_SSLENGINE.3 \
		CURLOPT_SSLENGINE_DEFAULT.3 CURLOPT_SSL_FALSESTART.3 \
		CURLOPT_SSLKEY.3 CURLOPT_SSLKEYTYPE.3 \
		CURLOPT_SSL_OPTIONS.3 CURLOPT_SSL_SESSIONID_CACHE.3 \
		CURLOPT_SSL_VERIFYHOST.3 CURLOPT_SSL_VERIFYPEER.3 \
		CURLOPT_SSL_VERIFYSTATUS.3 CURLOPT_SSLVERSION.3 CURLOPT_STDERR.3 \
		CURLOPT_TCP_KEEPALIVE.3 CURLOPT_TCP_KEEPIDLE.3 CURLOPT_TCP_KEEPINTVL.3 \
		CURLOPT_TCP_NODELAY.3 CURLOPT_TELNETOPTIONS.3 CURLOPT_TFTP_BLKSIZE.3 \
		CURLOPT_TIMECONDITION.3 CURLOPT_TIMEOUT.3 CURLOPT_TIMEOUT_MS.3 \
		CURLOPT_TIMEVALUE.3 CURLOPT_TLSAUTH_PASSWORD.3 CURLOPT_TLSAUTH_TYPE.3 \
		CURLOPT_SSLENGINE_DEFAULT.3 CURLOPT_SSL_FALSESTART.3 CURLOPT_SSLKEY.3 \
		CURLOPT_SSLKEYTYPE.3 CURLOPT_SSL_OPTIONS.3 \
		CURLOPT_SSL_SESSIONID_CACHE.3 CURLOPT_SSL_VERIFYHOST.3 \
		CURLOPT_SSL_VERIFYPEER.3 CURLOPT_SSL_VERIFYSTATUS.3 \
		CURLOPT_SSLVERSION.3 CURLOPT_STDERR.3 CURLOPT_TCP_KEEPALIVE.3 \
		CURLOPT_TCP_KEEPIDLE.3 CURLOPT_TCP_KEEPINTVL.3 CURLOPT_TCP_NODELAY.3 \
		CURLOPT_TELNETOPTIONS.3 CURLOPT_TFTP_BLKSIZE.3 CURLOPT_TIMECONDITION.3 \
		CURLOPT_TIMEOUT.3 CURLOPT_TIMEOUT_MS.3 CURLOPT_TIMEVALUE.3 \
		CURLOPT_TLSAUTH_PASSWORD.3 CURLOPT_TLSAUTH_TYPE.3 \
		CURLOPT_TLSAUTH_USERNAME.3 CURLOPT_TRANSFER_ENCODING.3 \
		CURLOPT_TRANSFERTEXT.3 CURLOPT_UNRESTRICTED_AUTH.3 CURLOPT_UPLOAD.3 \
		CURLOPT_URL.3 CURLOPT_USERAGENT.3 CURLOPT_USERNAME.3 CURLOPT_USERPWD.3 \
		@@ -111,8 +111,8 @@ man_MANS = CURLOPT_ACCEPT_ENCODING.3 CURLOPT_ACCEPTTIMEOUT_MS.3 \
		CURLMOPT_MAX_TOTAL_CONNECTIONS.3 CURLMOPT_PIPELINING.3 \
		CURLMOPT_PIPELINING_SERVER_BL.3 CURLMOPT_PIPELINING_SITE_BL.3 \
		CURLMOPT_SOCKETDATA.3 CURLMOPT_SOCKETFUNCTION.3 CURLMOPT_TIMERDATA.3 \
		CURLMOPT_TIMERFUNCTION.3 CURLOPT_UNIX_SOCKET_PATH.3

		CURLMOPT_TIMERFUNCTION.3 CURLOPT_UNIX_SOCKET_PATH.3 \
		CURLOPT_PATH_AS_IS.3

		HTMLPAGES = CURLOPT_ACCEPT_ENCODING.html CURLOPT_ACCEPTTIMEOUT_MS.html \
		CURLOPT_ADDRESS_SCOPE.html CURLOPT_APPEND.html \
		@@ -218,7 +218,7 @@ HTMLPAGES = CURLOPT_ACCEPT_ENCODING.html CURLOPT_ACCEPTTIMEOUT_MS.html \
		CURLMOPT_PIPELINING_SERVER_BL.html CURLMOPT_PIPELINING_SITE_BL.html \
		CURLMOPT_SOCKETDATA.html CURLMOPT_SOCKETFUNCTION.html \
		CURLMOPT_TIMERDATA.html CURLMOPT_TIMERFUNCTION.html \
		CURLOPT_UNIX_SOCKET_PATH.html
		CURLOPT_UNIX_SOCKET_PATH.html CURLOPT_PATH_AS_IS.html

		PDFPAGES = CURLOPT_ACCEPT_ENCODING.pdf CURLOPT_ACCEPTTIMEOUT_MS.pdf \
		CURLOPT_ADDRESS_SCOPE.pdf CURLOPT_APPEND.pdf CURLOPT_AUTOREFERER.pdf \
		@@ -321,7 +321,7 @@ PDFPAGES = CURLOPT_ACCEPT_ENCODING.pdf CURLOPT_ACCEPTTIMEOUT_MS.pdf \
		CURLMOPT_PIPELINING_SERVER_BL.pdf CURLMOPT_PIPELINING_SITE_BL.pdf \
		CURLMOPT_SOCKETDATA.pdf CURLMOPT_SOCKETFUNCTION.pdf \
		CURLMOPT_TIMERDATA.pdf CURLMOPT_TIMERFUNCTION.pdf \
		CURLOPT_UNIX_SOCKET_PATH.pdf
		CURLOPT_UNIX_SOCKET_PATH.pdf CURLOPT_PATH_AS_IS.pdf

		CLEANFILES = $(HTMLPAGES) $(PDFPAGES)

include/curl/curl.h

+4 −1

Original line number	Diff line number	Diff line
		@@ -7,7 +7,7 @@
		* \| (__\| \|_\| \| _ <\| \|___
		* \___\|\___/\|_\| \_\_____\|
		*
		* Copyright (C) 1998 - 2014, Daniel Stenberg, <daniel@haxx.se>, et al.
		* Copyright (C) 1998 - 2015, Daniel Stenberg, <daniel@haxx.se>, et al.
		*
		* This software is licensed as described in the file COPYING, which
		* you should have received as part of this distribution. The terms
		@@ -1629,6 +1629,9 @@ typedef enum {
		/* Set if we should enable TLS false start. */
		CINIT(SSL_FALSESTART, LONG, 233),

		/* Do not squash dot-dot sequences */
		CINIT(PATH_AS_IS, LONG, 234),

		CURLOPT_LASTENTRY /* the last unused */
		} CURLoption;

lib/url.c

+4 −1

Original line number	Diff line number	Diff line
		@@ -2613,6 +2613,9 @@ CURLcode Curl_setopt(struct SessionHandle *data, CURLoption option,
		break;
		#endif

		case CURLOPT_PATH_AS_IS:
		data->set.path_as_is = (0 != va_arg(param, long))?TRUE:FALSE;
		break;
		default:
		/* unknown tag and its companion, just ignore: */
		result = CURLE_UNKNOWN_OPTION;
		@@ -4036,7 +4039,7 @@ static CURLcode parseurlandfillconn(struct SessionHandle *data,
		path[0] = '/';
		rebuild_url = TRUE;
		}
		else {
		else if(!data->set.path_as_is) {
		/* sanitise paths and remove ../ and ./ sequences according to RFC3986 */
		char *newp = Curl_dedotdotify(path);
		if(!newp)