moparisthebest/wget
1
0
Fork 0
mirror of https://github.com/moparisthebest/wget synced 2024-07-03 16:38:41 -04:00
Code Issues Releases Wiki Activity

[svn] Prevent newlines in FTP command arguments causing inadvertent sending of

Browse Source 
multiple FTP commands.
This commit is contained in:
hniksic 2005-05-06 18:06:26 -07:00
parent 5aba2a5850
commit 9bdeaf453d
2 changed files with 26 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/ChangeLog
View File

@ -1,3 +1,8 @@
2005-05-07 Hrvoje Niksic <hniksic@xemacs.org>
* ftp-basic.c (ftp_request): Prevent newlines in VALUE causing
inadvertent sending of multiple FTP commands.
2005-05-07 Hrvoje Niksic <hniksic@xemacs.org> 2005-05-07 Hrvoje Niksic <hniksic@xemacs.org>
* url.c (decide_copy_method): Never cause reencode_escapes to * url.c (decide_copy_method): Never cause reencode_escapes to

20
src/ftp-basic.c
View File

@ -103,7 +103,27 @@ ftp_request (const char *command, const char *value)
{ {
char *res; char *res;
if (value) if (value)
{
/* Check for newlines in VALUE (possibly injected by the %0A URL
escape) making the callers inadvertently send multiple FTP
commands at once. Without this check an attacker could
intentionally redirect to ftp://server/fakedir%0Acommand.../
and execute arbitrary FTP command on a remote FTP server. */
if (strpbrk (value, "\r\n"))
{
/* Copy VALUE to the stack and modify CR/LF to space. */
char *defanged, *p;
STRDUP_ALLOCA (defanged, value);
for (p = defanged; *p; p++)
if (*p == '\r' || *p == '\n')
*p = ' ';
DEBUGP (("\nDetected newlines in %s \"%s\"; changing to %s \"%s\"\n",
command, escnonprint (value), command, escnonprint (defanged)));
/* Make VALUE point to the defanged copy of the string. */
value = defanged;
}
res = concat_strings (command, " ", value, "\r\n", (char *) 0); res = concat_strings (command, " ", value, "\r\n", (char *) 0);
}
else else
res = concat_strings (command, "\r\n", (char *) 0); res = concat_strings (command, "\r\n", (char *) 0);
if (opt.server_response) if (opt.server_response)