luo980/curl
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

url: do not URL decode proxy crendentials

Browse Source 
The two options CURLOPT_PROXYUSERNAME and CURLOPT_PROXYPASSWORD set the
actual names as-is, not URL encoded.

Modified test 503 to use percent-encoded strings in the credential
strings that should be passed on as-is.

Reported-by: Sergey Ogryzkov
Fixes #13265
Closes #13270
This commit is contained in:
Daniel Stenberg 2024-04-03 11:32:55 +02:00
parent 29bfde9fea
commit d5e83eb745
No known key found for this signature in database
GPG Key ID: 5CC908FDB71E12C2
4 changed files with 30 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
lib/setopt.c
View File

@ -52,6 +52,8 @@
#include "hsts.h"
#include "tftp.h"
#include "strdup.h"
#include "escape.h"
/* The last 3 #include files should be in this order */
#include "curl_printf.h"
#include "curl_memory.h"
@ -1593,13 +1595,24 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param)
break;
#ifndef CURL_DISABLE_PROXY
case CURLOPT_PROXYUSERPWD:
case CURLOPT_PROXYUSERPWD: {
/*
* user:password needed to use the proxy
*/
result = setstropt_userpwd(va_arg(param, char *),
&data->set.str[STRING_PROXYUSERNAME],
&data->set.str[STRING_PROXYPASSWORD]);
char *u = NULL;
char *p = NULL;
result = setstropt_userpwd(va_arg(param, char *), &u, &p);
/* URL decode the components */
if(!result && u)
result = Curl_urldecode(u, 0, &data->set.str[STRING_PROXYUSERNAME], NULL,
REJECT_ZERO);
if(!result && p)
result = Curl_urldecode(p, 0, &data->set.str[STRING_PROXYPASSWORD], NULL,
REJECT_ZERO);
free(u);
free(p);
}
break;
case CURLOPT_PROXYUSERNAME:
/*

21
lib/url.c
View File

@ -2366,17 +2366,16 @@ static CURLcode parse_proxy_auth(struct Curl_easy *data,
data->state.aptr.proxyuser : "";
const char *proxypasswd = data->state.aptr.proxypasswd ?
data->state.aptr.proxypasswd : "";
CURLcode result = Curl_urldecode(proxyuser, 0, &conn->http_proxy.user, NULL,
REJECT_ZERO);
if(!result)
result = Curl_setstropt(&data->state.aptr.proxyuser,
conn->http_proxy.user);
if(!result)
result = Curl_urldecode(proxypasswd, 0, &conn->http_proxy.passwd,
NULL, REJECT_ZERO);
if(!result)
result = Curl_setstropt(&data->state.aptr.proxypasswd,
conn->http_proxy.passwd);
CURLcode result = CURLE_OUT_OF_MEMORY;
conn->http_proxy.user = strdup(proxyuser);
if(conn->http_proxy.user) {
conn->http_proxy.passwd = strdup(proxypasswd);
if(conn->http_proxy.passwd)
result = CURLE_OK;
else
Curl_safefree(conn->http_proxy.user);
}
return result;
}

2
tests/data/test503
View File

@ -73,7 +73,7 @@ moo
<proxy>
CONNECT machine.%TESTNUMBER:%HTTPPORT HTTP/1.1
Host: machine.%TESTNUMBER:%HTTPPORT
Proxy-Authorization: Basic dGVzdDppbmc=
Proxy-Authorization: Basic dGVzdCUyMDppbmclNDE=
Proxy-Connection: Keep-Alive
[DISCONNECT]

3
tests/libtest/lib503.c
View File

@ -53,7 +53,8 @@ int test(char *URL)
easy_setopt(c, CURLOPT_PROXY, libtest_arg2); /* set in first.c */
easy_setopt(c, CURLOPT_URL, URL);
easy_setopt(c, CURLOPT_USERPWD, "test:ing");
easy_setopt(c, CURLOPT_PROXYUSERPWD, "test:ing");
easy_setopt(c, CURLOPT_PROXYUSERNAME, "test%20");
easy_setopt(c, CURLOPT_PROXYPASSWORD, "ing%41");
easy_setopt(c, CURLOPT_HTTPPROXYTUNNEL, 1L);
easy_setopt(c, CURLOPT_HEADER, 1L);
easy_setopt(c, CURLOPT_VERBOSE, 1L);