tests: verify the fix for CVE-2022-27774
- Test 973 redirects from HTTP to FTP, clear auth - Test 974 redirects from HTTP to HTTP different port, clear auth - Test 975 redirects from HTTP to FTP, permitted to keep auth - Test 976 redirects from HTTP to HTTP different port, permitted to keep auth
This commit is contained in:
Daniel Stenberg
parent
620ea21410
commit
5295e8d64a
@ -119,7 +119,7 @@ test936 test937 test938 test939 test940 test941 test942 test943 test944 \
|
||||
test945 test946 test947 test948 test949 test950 test951 test952 test953 \
|
||||
test954 test955 test956 test957 test958 test959 test960 test961 test962 \
|
||||
test963 test964 test965 test966 test967 test968 test969 test970 test971 \
|
||||
test972 \
|
||||
test972 test973 test974 test975 test976 \
|
||||
\
|
||||
test980 test981 test982 test983 test984 test985 test986 \
|
||||
\
|
||||
|
||||
88
tests/data/test973
Normal file
88
tests/data/test973
Normal file
@ -0,0 +1,88 @@
|
||||
<testcase>
|
||||
<info>
|
||||
<keywords>
|
||||
HTTP
|
||||
FTP
|
||||
--location
|
||||
</keywords>
|
||||
</info>
|
||||
|
||||
#
|
||||
# Server-side
|
||||
<reply>
|
||||
<data>
|
||||
HTTP/1.1 301 redirect
|
||||
Date: Tue, 09 Nov 2010 14:49:00 GMT
|
||||
Server: test-server/fake
|
||||
Content-Length: 0
|
||||
Connection: close
|
||||
Content-Type: text/html
|
||||
Location: ftp://%HOSTIP:%FTPPORT/a/path/%TESTNUMBER0002
|
||||
|
||||
</data>
|
||||
<data2>
|
||||
data
|
||||
to
|
||||
see
|
||||
that FTP
|
||||
works
|
||||
so does it?
|
||||
</data2>
|
||||
|
||||
<datacheck>
|
||||
HTTP/1.1 301 redirect
|
||||
Date: Tue, 09 Nov 2010 14:49:00 GMT
|
||||
Server: test-server/fake
|
||||
Content-Length: 0
|
||||
Connection: close
|
||||
Content-Type: text/html
|
||||
Location: ftp://%HOSTIP:%FTPPORT/a/path/%TESTNUMBER0002
|
||||
|
||||
data
|
||||
to
|
||||
see
|
||||
that FTP
|
||||
works
|
||||
so does it?
|
||||
</datacheck>
|
||||
|
||||
</reply>
|
||||
|
||||
#
|
||||
# Client-side
|
||||
<client>
|
||||
<server>
|
||||
http
|
||||
ftp
|
||||
</server>
|
||||
<name>
|
||||
HTTP with auth redirected to FTP w/o auth
|
||||
</name>
|
||||
<command>
|
||||
http://%HOSTIP:%HTTPPORT/%TESTNUMBER -L -u joe:secret
|
||||
</command>
|
||||
</client>
|
||||
|
||||
#
|
||||
# Verify data after the test has been "shot"
|
||||
<verify>
|
||||
<protocol>
|
||||
GET /%TESTNUMBER HTTP/1.1
|
||||
Host: %HOSTIP:%HTTPPORT
|
||||
Authorization: Basic am9lOnNlY3JldA==
|
||||
User-Agent: curl/%VERSION
|
||||
Accept: */*
|
||||
|
||||
USER anonymous
|
||||
PASS ftp@example.com
|
||||
PWD
|
||||
CWD a
|
||||
CWD path
|
||||
EPSV
|
||||
TYPE I
|
||||
SIZE %TESTNUMBER0002
|
||||
RETR %TESTNUMBER0002
|
||||
QUIT
|
||||
</protocol>
|
||||
</verify>
|
||||
</testcase>
|
||||
87
tests/data/test974
Normal file
87
tests/data/test974
Normal file
@ -0,0 +1,87 @@
|
||||
<testcase>
|
||||
<info>
|
||||
<keywords>
|
||||
HTTP
|
||||
--location
|
||||
</keywords>
|
||||
</info>
|
||||
|
||||
#
|
||||
# Server-side
|
||||
<reply>
|
||||
<data>
|
||||
HTTP/1.1 301 redirect
|
||||
Date: Tue, 09 Nov 2010 14:49:00 GMT
|
||||
Server: test-server/fake
|
||||
Content-Length: 0
|
||||
Connection: close
|
||||
Content-Type: text/html
|
||||
Location: http://firsthost.com:9999/a/path/%TESTNUMBER0002
|
||||
|
||||
</data>
|
||||
<data2>
|
||||
HTTP/1.1 200 OK
|
||||
Date: Tue, 09 Nov 2010 14:49:00 GMT
|
||||
Server: test-server/fake
|
||||
Content-Length: 4
|
||||
Connection: close
|
||||
Content-Type: text/html
|
||||
|
||||
hey
|
||||
</data2>
|
||||
|
||||
<datacheck>
|
||||
HTTP/1.1 301 redirect
|
||||
Date: Tue, 09 Nov 2010 14:49:00 GMT
|
||||
Server: test-server/fake
|
||||
Content-Length: 0
|
||||
Connection: close
|
||||
Content-Type: text/html
|
||||
Location: http://firsthost.com:9999/a/path/%TESTNUMBER0002
|
||||
|
||||
HTTP/1.1 200 OK
|
||||
Date: Tue, 09 Nov 2010 14:49:00 GMT
|
||||
Server: test-server/fake
|
||||
Content-Length: 4
|
||||
Connection: close
|
||||
Content-Type: text/html
|
||||
|
||||
hey
|
||||
</datacheck>
|
||||
|
||||
</reply>
|
||||
|
||||
#
|
||||
# Client-side
|
||||
<client>
|
||||
<server>
|
||||
http
|
||||
</server>
|
||||
<name>
|
||||
HTTP with auth redirected to HTTP on a diff port w/o auth
|
||||
</name>
|
||||
<command>
|
||||
-x http://%HOSTIP:%HTTPPORT http://firsthost.com -L -u joe:secret
|
||||
</command>
|
||||
</client>
|
||||
|
||||
#
|
||||
# Verify data after the test has been "shot"
|
||||
<verify>
|
||||
<protocol>
|
||||
GET http://firsthost.com/ HTTP/1.1
|
||||
Host: firsthost.com
|
||||
Authorization: Basic am9lOnNlY3JldA==
|
||||
User-Agent: curl/%VERSION
|
||||
Accept: */*
|
||||
Proxy-Connection: Keep-Alive
|
||||
|
||||
GET http://firsthost.com:9999/a/path/%TESTNUMBER0002 HTTP/1.1
|
||||
Host: firsthost.com:9999
|
||||
User-Agent: curl/%VERSION
|
||||
Accept: */*
|
||||
Proxy-Connection: Keep-Alive
|
||||
|
||||
</protocol>
|
||||
</verify>
|
||||
</testcase>
|
||||
88
tests/data/test975
Normal file
88
tests/data/test975
Normal file
@ -0,0 +1,88 @@
|
||||
<testcase>
|
||||
<info>
|
||||
<keywords>
|
||||
HTTP
|
||||
FTP
|
||||
--location-trusted
|
||||
</keywords>
|
||||
</info>
|
||||
|
||||
#
|
||||
# Server-side
|
||||
<reply>
|
||||
<data>
|
||||
HTTP/1.1 301 redirect
|
||||
Date: Tue, 09 Nov 2010 14:49:00 GMT
|
||||
Server: test-server/fake
|
||||
Content-Length: 0
|
||||
Connection: close
|
||||
Content-Type: text/html
|
||||
Location: ftp://%HOSTIP:%FTPPORT/a/path/%TESTNUMBER0002
|
||||
|
||||
</data>
|
||||
<data2>
|
||||
data
|
||||
to
|
||||
see
|
||||
that FTP
|
||||
works
|
||||
so does it?
|
||||
</data2>
|
||||
|
||||
<datacheck>
|
||||
HTTP/1.1 301 redirect
|
||||
Date: Tue, 09 Nov 2010 14:49:00 GMT
|
||||
Server: test-server/fake
|
||||
Content-Length: 0
|
||||
Connection: close
|
||||
Content-Type: text/html
|
||||
Location: ftp://%HOSTIP:%FTPPORT/a/path/%TESTNUMBER0002
|
||||
|
||||
data
|
||||
to
|
||||
see
|
||||
that FTP
|
||||
works
|
||||
so does it?
|
||||
</datacheck>
|
||||
|
||||
</reply>
|
||||
|
||||
#
|
||||
# Client-side
|
||||
<client>
|
||||
<server>
|
||||
http
|
||||
ftp
|
||||
</server>
|
||||
<name>
|
||||
HTTP with auth redirected to FTP allowing auth to continue
|
||||
</name>
|
||||
<command>
|
||||
http://%HOSTIP:%HTTPPORT/%TESTNUMBER --location-trusted -u joe:secret
|
||||
</command>
|
||||
</client>
|
||||
|
||||
#
|
||||
# Verify data after the test has been "shot"
|
||||
<verify>
|
||||
<protocol>
|
||||
GET /%TESTNUMBER HTTP/1.1
|
||||
Host: %HOSTIP:%HTTPPORT
|
||||
Authorization: Basic am9lOnNlY3JldA==
|
||||
User-Agent: curl/%VERSION
|
||||
Accept: */*
|
||||
|
||||
USER joe
|
||||
PASS secret
|
||||
PWD
|
||||
CWD a
|
||||
CWD path
|
||||
EPSV
|
||||
TYPE I
|
||||
SIZE %TESTNUMBER0002
|
||||
RETR %TESTNUMBER0002
|
||||
QUIT
|
||||
</protocol>
|
||||
</verify>
|
||||
</testcase>
|
||||
88
tests/data/test976
Normal file
88
tests/data/test976
Normal file
@ -0,0 +1,88 @@
|
||||
<testcase>
|
||||
<info>
|
||||
<keywords>
|
||||
HTTP
|
||||
--location-trusted
|
||||
</keywords>
|
||||
</info>
|
||||
|
||||
#
|
||||
# Server-side
|
||||
<reply>
|
||||
<data>
|
||||
HTTP/1.1 301 redirect
|
||||
Date: Tue, 09 Nov 2010 14:49:00 GMT
|
||||
Server: test-server/fake
|
||||
Content-Length: 0
|
||||
Connection: close
|
||||
Content-Type: text/html
|
||||
Location: http://firsthost.com:9999/a/path/%TESTNUMBER0002
|
||||
|
||||
</data>
|
||||
<data2>
|
||||
HTTP/1.1 200 OK
|
||||
Date: Tue, 09 Nov 2010 14:49:00 GMT
|
||||
Server: test-server/fake
|
||||
Content-Length: 4
|
||||
Connection: close
|
||||
Content-Type: text/html
|
||||
|
||||
hey
|
||||
</data2>
|
||||
|
||||
<datacheck>
|
||||
HTTP/1.1 301 redirect
|
||||
Date: Tue, 09 Nov 2010 14:49:00 GMT
|
||||
Server: test-server/fake
|
||||
Content-Length: 0
|
||||
Connection: close
|
||||
Content-Type: text/html
|
||||
Location: http://firsthost.com:9999/a/path/%TESTNUMBER0002
|
||||
|
||||
HTTP/1.1 200 OK
|
||||
Date: Tue, 09 Nov 2010 14:49:00 GMT
|
||||
Server: test-server/fake
|
||||
Content-Length: 4
|
||||
Connection: close
|
||||
Content-Type: text/html
|
||||
|
||||
hey
|
||||
</datacheck>
|
||||
|
||||
</reply>
|
||||
|
||||
#
|
||||
# Client-side
|
||||
<client>
|
||||
<server>
|
||||
http
|
||||
</server>
|
||||
<name>
|
||||
HTTP with auth redirected to HTTP on a diff port --location-trusted
|
||||
</name>
|
||||
<command>
|
||||
-x http://%HOSTIP:%HTTPPORT http://firsthost.com --location-trusted -u joe:secret
|
||||
</command>
|
||||
</client>
|
||||
|
||||
#
|
||||
# Verify data after the test has been "shot"
|
||||
<verify>
|
||||
<protocol>
|
||||
GET http://firsthost.com/ HTTP/1.1
|
||||
Host: firsthost.com
|
||||
Authorization: Basic am9lOnNlY3JldA==
|
||||
User-Agent: curl/%VERSION
|
||||
Accept: */*
|
||||
Proxy-Connection: Keep-Alive
|
||||
|
||||
GET http://firsthost.com:9999/a/path/%TESTNUMBER0002 HTTP/1.1
|
||||
Host: firsthost.com:9999
|
||||
Authorization: Basic am9lOnNlY3JldA==
|
||||
User-Agent: curl/%VERSION
|
||||
Accept: */*
|
||||
Proxy-Connection: Keep-Alive
|
||||
|
||||
</protocol>
|
||||
</verify>
|
||||
</testcase>
|
||||
Loading…
Reference in New Issue
Block a user