tests: verify the fix for CVE-2022-27774
- Test 973 redirects from HTTP to FTP, clear auth - Test 974 redirects from HTTP to HTTP different port, clear auth - Test 975 redirects from HTTP to FTP, permitted to keep auth - Test 976 redirects from HTTP to HTTP different port, permitted to keep auth
This commit is contained in:
Daniel Stenberg
parent
620ea21410
commit
5295e8d64a
@ -119,7 +119,7 @@ test936 test937 test938 test939 test940 test941 test942 test943 test944 \
|
|||||||
test945 test946 test947 test948 test949 test950 test951 test952 test953 \
|
test945 test946 test947 test948 test949 test950 test951 test952 test953 \
|
||||||
test954 test955 test956 test957 test958 test959 test960 test961 test962 \
|
test954 test955 test956 test957 test958 test959 test960 test961 test962 \
|
||||||
test963 test964 test965 test966 test967 test968 test969 test970 test971 \
|
test963 test964 test965 test966 test967 test968 test969 test970 test971 \
|
||||||
test972 \
|
test972 test973 test974 test975 test976 \
|
||||||
\
|
\
|
||||||
test980 test981 test982 test983 test984 test985 test986 \
|
test980 test981 test982 test983 test984 test985 test986 \
|
||||||
\
|
\
|
||||||
|
|||||||
88
tests/data/test973
Normal file
88
tests/data/test973
Normal file
@ -0,0 +1,88 @@
|
|||||||
|
<testcase>
|
||||||
|
<info>
|
||||||
|
<keywords>
|
||||||
|
HTTP
|
||||||
|
FTP
|
||||||
|
--location
|
||||||
|
</keywords>
|
||||||
|
</info>
|
||||||
|
|
||||||
|
#
|
||||||
|
# Server-side
|
||||||
|
<reply>
|
||||||
|
<data>
|
||||||
|
HTTP/1.1 301 redirect
|
||||||
|
Date: Tue, 09 Nov 2010 14:49:00 GMT
|
||||||
|
Server: test-server/fake
|
||||||
|
Content-Length: 0
|
||||||
|
Connection: close
|
||||||
|
Content-Type: text/html
|
||||||
|
Location: ftp://%HOSTIP:%FTPPORT/a/path/%TESTNUMBER0002
|
||||||
|
|
||||||
|
</data>
|
||||||
|
<data2>
|
||||||
|
data
|
||||||
|
to
|
||||||
|
see
|
||||||
|
that FTP
|
||||||
|
works
|
||||||
|
so does it?
|
||||||
|
</data2>
|
||||||
|
|
||||||
|
<datacheck>
|
||||||
|
HTTP/1.1 301 redirect
|
||||||
|
Date: Tue, 09 Nov 2010 14:49:00 GMT
|
||||||
|
Server: test-server/fake
|
||||||
|
Content-Length: 0
|
||||||
|
Connection: close
|
||||||
|
Content-Type: text/html
|
||||||
|
Location: ftp://%HOSTIP:%FTPPORT/a/path/%TESTNUMBER0002
|
||||||
|
|
||||||
|
data
|
||||||
|
to
|
||||||
|
see
|
||||||
|
that FTP
|
||||||
|
works
|
||||||
|
so does it?
|
||||||
|
</datacheck>
|
||||||
|
|
||||||
|
</reply>
|
||||||
|
|
||||||
|
#
|
||||||
|
# Client-side
|
||||||
|
<client>
|
||||||
|
<server>
|
||||||
|
http
|
||||||
|
ftp
|
||||||
|
</server>
|
||||||
|
<name>
|
||||||
|
HTTP with auth redirected to FTP w/o auth
|
||||||
|
</name>
|
||||||
|
<command>
|
||||||
|
http://%HOSTIP:%HTTPPORT/%TESTNUMBER -L -u joe:secret
|
||||||
|
</command>
|
||||||
|
</client>
|
||||||
|
|
||||||
|
#
|
||||||
|
# Verify data after the test has been "shot"
|
||||||
|
<verify>
|
||||||
|
<protocol>
|
||||||
|
GET /%TESTNUMBER HTTP/1.1
|
||||||
|
Host: %HOSTIP:%HTTPPORT
|
||||||
|
Authorization: Basic am9lOnNlY3JldA==
|
||||||
|
User-Agent: curl/%VERSION
|
||||||
|
Accept: */*
|
||||||
|
|
||||||
|
USER anonymous
|
||||||
|
PASS ftp@example.com
|
||||||
|
PWD
|
||||||
|
CWD a
|
||||||
|
CWD path
|
||||||
|
EPSV
|
||||||
|
TYPE I
|
||||||
|
SIZE %TESTNUMBER0002
|
||||||
|
RETR %TESTNUMBER0002
|
||||||
|
QUIT
|
||||||
|
</protocol>
|
||||||
|
</verify>
|
||||||
|
</testcase>
|
||||||
87
tests/data/test974
Normal file
87
tests/data/test974
Normal file
@ -0,0 +1,87 @@
|
|||||||
|
<testcase>
|
||||||
|
<info>
|
||||||
|
<keywords>
|
||||||
|
HTTP
|
||||||
|
--location
|
||||||
|
</keywords>
|
||||||
|
</info>
|
||||||
|
|
||||||
|
#
|
||||||
|
# Server-side
|
||||||
|
<reply>
|
||||||
|
<data>
|
||||||
|
HTTP/1.1 301 redirect
|
||||||
|
Date: Tue, 09 Nov 2010 14:49:00 GMT
|
||||||
|
Server: test-server/fake
|
||||||
|
Content-Length: 0
|
||||||
|
Connection: close
|
||||||
|
Content-Type: text/html
|
||||||
|
Location: http://firsthost.com:9999/a/path/%TESTNUMBER0002
|
||||||
|
|
||||||
|
</data>
|
||||||
|
<data2>
|
||||||
|
HTTP/1.1 200 OK
|
||||||
|
Date: Tue, 09 Nov 2010 14:49:00 GMT
|
||||||
|
Server: test-server/fake
|
||||||
|
Content-Length: 4
|
||||||
|
Connection: close
|
||||||
|
Content-Type: text/html
|
||||||
|
|
||||||
|
hey
|
||||||
|
</data2>
|
||||||
|
|
||||||
|
<datacheck>
|
||||||
|
HTTP/1.1 301 redirect
|
||||||
|
Date: Tue, 09 Nov 2010 14:49:00 GMT
|
||||||
|
Server: test-server/fake
|
||||||
|
Content-Length: 0
|
||||||
|
Connection: close
|
||||||
|
Content-Type: text/html
|
||||||
|
Location: http://firsthost.com:9999/a/path/%TESTNUMBER0002
|
||||||
|
|
||||||
|
HTTP/1.1 200 OK
|
||||||
|
Date: Tue, 09 Nov 2010 14:49:00 GMT
|
||||||
|
Server: test-server/fake
|
||||||
|
Content-Length: 4
|
||||||
|
Connection: close
|
||||||
|
Content-Type: text/html
|
||||||
|
|
||||||
|
hey
|
||||||
|
</datacheck>
|
||||||
|
|
||||||
|
</reply>
|
||||||
|
|
||||||
|
#
|
||||||
|
# Client-side
|
||||||
|
<client>
|
||||||
|
<server>
|
||||||
|
http
|
||||||
|
</server>
|
||||||
|
<name>
|
||||||
|
HTTP with auth redirected to HTTP on a diff port w/o auth
|
||||||
|
</name>
|
||||||
|
<command>
|
||||||
|
-x http://%HOSTIP:%HTTPPORT http://firsthost.com -L -u joe:secret
|
||||||
|
</command>
|
||||||
|
</client>
|
||||||
|
|
||||||
|
#
|
||||||
|
# Verify data after the test has been "shot"
|
||||||
|
<verify>
|
||||||
|
<protocol>
|
||||||
|
GET http://firsthost.com/ HTTP/1.1
|
||||||
|
Host: firsthost.com
|
||||||
|
Authorization: Basic am9lOnNlY3JldA==
|
||||||
|
User-Agent: curl/%VERSION
|
||||||
|
Accept: */*
|
||||||
|
Proxy-Connection: Keep-Alive
|
||||||
|
|
||||||
|
GET http://firsthost.com:9999/a/path/%TESTNUMBER0002 HTTP/1.1
|
||||||
|
Host: firsthost.com:9999
|
||||||
|
User-Agent: curl/%VERSION
|
||||||
|
Accept: */*
|
||||||
|
Proxy-Connection: Keep-Alive
|
||||||
|
|
||||||
|
</protocol>
|
||||||
|
</verify>
|
||||||
|
</testcase>
|
||||||
88
tests/data/test975
Normal file
88
tests/data/test975
Normal file
@ -0,0 +1,88 @@
|
|||||||
|
<testcase>
|
||||||
|
<info>
|
||||||
|
<keywords>
|
||||||
|
HTTP
|
||||||
|
FTP
|
||||||
|
--location-trusted
|
||||||
|
</keywords>
|
||||||
|
</info>
|
||||||
|
|
||||||
|
#
|
||||||
|
# Server-side
|
||||||
|
<reply>
|
||||||
|
<data>
|
||||||
|
HTTP/1.1 301 redirect
|
||||||
|
Date: Tue, 09 Nov 2010 14:49:00 GMT
|
||||||
|
Server: test-server/fake
|
||||||
|
Content-Length: 0
|
||||||
|
Connection: close
|
||||||
|
Content-Type: text/html
|
||||||
|
Location: ftp://%HOSTIP:%FTPPORT/a/path/%TESTNUMBER0002
|
||||||
|
|
||||||
|
</data>
|
||||||
|
<data2>
|
||||||
|
data
|
||||||
|
to
|
||||||
|
see
|
||||||
|
that FTP
|
||||||
|
works
|
||||||
|
so does it?
|
||||||
|
</data2>
|
||||||
|
|
||||||
|
<datacheck>
|
||||||
|
HTTP/1.1 301 redirect
|
||||||
|
Date: Tue, 09 Nov 2010 14:49:00 GMT
|
||||||
|
Server: test-server/fake
|
||||||
|
Content-Length: 0
|
||||||
|
Connection: close
|
||||||
|
Content-Type: text/html
|
||||||
|
Location: ftp://%HOSTIP:%FTPPORT/a/path/%TESTNUMBER0002
|
||||||
|
|
||||||
|
data
|
||||||
|
to
|
||||||
|
see
|
||||||
|
that FTP
|
||||||
|
works
|
||||||
|
so does it?
|
||||||
|
</datacheck>
|
||||||
|
|
||||||
|
</reply>
|
||||||
|
|
||||||
|
#
|
||||||
|
# Client-side
|
||||||
|
<client>
|
||||||
|
<server>
|
||||||
|
http
|
||||||
|
ftp
|
||||||
|
</server>
|
||||||
|
<name>
|
||||||
|
HTTP with auth redirected to FTP allowing auth to continue
|
||||||
|
</name>
|
||||||
|
<command>
|
||||||
|
http://%HOSTIP:%HTTPPORT/%TESTNUMBER --location-trusted -u joe:secret
|
||||||
|
</command>
|
||||||
|
</client>
|
||||||
|
|
||||||
|
#
|
||||||
|
# Verify data after the test has been "shot"
|
||||||
|
<verify>
|
||||||
|
<protocol>
|
||||||
|
GET /%TESTNUMBER HTTP/1.1
|
||||||
|
Host: %HOSTIP:%HTTPPORT
|
||||||
|
Authorization: Basic am9lOnNlY3JldA==
|
||||||
|
User-Agent: curl/%VERSION
|
||||||
|
Accept: */*
|
||||||
|
|
||||||
|
USER joe
|
||||||
|
PASS secret
|
||||||
|
PWD
|
||||||
|
CWD a
|
||||||
|
CWD path
|
||||||
|
EPSV
|
||||||
|
TYPE I
|
||||||
|
SIZE %TESTNUMBER0002
|
||||||
|
RETR %TESTNUMBER0002
|
||||||
|
QUIT
|
||||||
|
</protocol>
|
||||||
|
</verify>
|
||||||
|
</testcase>
|
||||||
88
tests/data/test976
Normal file
88
tests/data/test976
Normal file
@ -0,0 +1,88 @@
|
|||||||
|
<testcase>
|
||||||
|
<info>
|
||||||
|
<keywords>
|
||||||
|
HTTP
|
||||||
|
--location-trusted
|
||||||
|
</keywords>
|
||||||
|
</info>
|
||||||
|
|
||||||
|
#
|
||||||
|
# Server-side
|
||||||
|
<reply>
|
||||||
|
<data>
|
||||||
|
HTTP/1.1 301 redirect
|
||||||
|
Date: Tue, 09 Nov 2010 14:49:00 GMT
|
||||||
|
Server: test-server/fake
|
||||||
|
Content-Length: 0
|
||||||
|
Connection: close
|
||||||
|
Content-Type: text/html
|
||||||
|
Location: http://firsthost.com:9999/a/path/%TESTNUMBER0002
|
||||||
|
|
||||||
|
</data>
|
||||||
|
<data2>
|
||||||
|
HTTP/1.1 200 OK
|
||||||
|
Date: Tue, 09 Nov 2010 14:49:00 GMT
|
||||||
|
Server: test-server/fake
|
||||||
|
Content-Length: 4
|
||||||
|
Connection: close
|
||||||
|
Content-Type: text/html
|
||||||
|
|
||||||
|
hey
|
||||||
|
</data2>
|
||||||
|
|
||||||
|
<datacheck>
|
||||||
|
HTTP/1.1 301 redirect
|
||||||
|
Date: Tue, 09 Nov 2010 14:49:00 GMT
|
||||||
|
Server: test-server/fake
|
||||||
|
Content-Length: 0
|
||||||
|
Connection: close
|
||||||
|
Content-Type: text/html
|
||||||
|
Location: http://firsthost.com:9999/a/path/%TESTNUMBER0002
|
||||||
|
|
||||||
|
HTTP/1.1 200 OK
|
||||||
|
Date: Tue, 09 Nov 2010 14:49:00 GMT
|
||||||
|
Server: test-server/fake
|
||||||
|
Content-Length: 4
|
||||||
|
Connection: close
|
||||||
|
Content-Type: text/html
|
||||||
|
|
||||||
|
hey
|
||||||
|
</datacheck>
|
||||||
|
|
||||||
|
</reply>
|
||||||
|
|
||||||
|
#
|
||||||
|
# Client-side
|
||||||
|
<client>
|
||||||
|
<server>
|
||||||
|
http
|
||||||
|
</server>
|
||||||
|
<name>
|
||||||
|
HTTP with auth redirected to HTTP on a diff port --location-trusted
|
||||||
|
</name>
|
||||||
|
<command>
|
||||||
|
-x http://%HOSTIP:%HTTPPORT http://firsthost.com --location-trusted -u joe:secret
|
||||||
|
</command>
|
||||||
|
</client>
|
||||||
|
|
||||||
|
#
|
||||||
|
# Verify data after the test has been "shot"
|
||||||
|
<verify>
|
||||||
|
<protocol>
|
||||||
|
GET http://firsthost.com/ HTTP/1.1
|
||||||
|
Host: firsthost.com
|
||||||
|
Authorization: Basic am9lOnNlY3JldA==
|
||||||
|
User-Agent: curl/%VERSION
|
||||||
|
Accept: */*
|
||||||
|
Proxy-Connection: Keep-Alive
|
||||||
|
|
||||||
|
GET http://firsthost.com:9999/a/path/%TESTNUMBER0002 HTTP/1.1
|
||||||
|
Host: firsthost.com:9999
|
||||||
|
Authorization: Basic am9lOnNlY3JldA==
|
||||||
|
User-Agent: curl/%VERSION
|
||||||
|
Accept: */*
|
||||||
|
Proxy-Connection: Keep-Alive
|
||||||
|
|
||||||
|
</protocol>
|
||||||
|
</verify>
|
||||||
|
</testcase>
|
||||||
Loading…
Reference in New Issue
Block a user