diff options
| author | Daniel Stenberg <daniel@haxx.se> | 2011-12-23 13:24:16 +0100 |
|---|---|---|
| committer | Daniel Stenberg <daniel@haxx.se> | 2012-01-24 08:54:26 +0100 |
| commit | 75ca568fa1c19de4c5358fed246686de8467c238 (patch) | |
| tree | 3defa5cba8cb2105499cc762810274d27d44cfd6 /lib/imap.c | |
| parent | db1a856b4f7cf6ae334fb0656b26a18eea317000 (diff) | |
URL sanitize: reject URLs containing bad data
Protocols (IMAP, POP3 and SMTP) that use the path part of a URL in a
decoded manner now use the new Curl_urldecode() function to reject URLs
with embedded control codes (anything that is or decodes to a byte value
less than 32).
URLs containing such codes could easily otherwise be used to do harm and
allow users to do unintended actions with otherwise innocent tools and
applications. Like for example using a URL like
pop3://pop3.example.com/1%0d%0aDELE%201 when the app wants a URL to get
a mail and instead this would delete one.
This flaw is considered a security vulnerability: CVE-2012-0036
Security advisory at: http://curl.haxx.se/docs/adv_20120124.html
Reported by: Dan Fandrich
Diffstat (limited to 'lib/imap.c')
| -rw-r--r-- | lib/imap.c | 7 |
1 files changed, 1 insertions, 6 deletions
diff --git a/lib/imap.c b/lib/imap.c index c39664d86..c6701417d 100644 --- a/lib/imap.c +++ b/lib/imap.c @@ -953,17 +953,12 @@ static CURLcode imap_parse_url_path(struct connectdata *conn) struct imap_conn *imapc = &conn->proto.imapc; struct SessionHandle *data = conn->data; const char *path = data->state.path; - int len; if(!*path) path = "INBOX"; /* url decode the path and use this mailbox */ - imapc->mailbox = curl_easy_unescape(data, path, 0, &len); - if(!imapc->mailbox) - return CURLE_OUT_OF_MEMORY; - - return CURLE_OK; + return Curl_urldecode(data, path, 0, &imapc->mailbox, NULL, TRUE); } /* call this when the DO phase has completed */ |