libfetch: Reject control characters in credentials
ClosedPublic
Actions

Authored by des on Fri, Sep 25, 10:37 AM.

Details

Reviewers

markj

Commits

rGb319c3d6ac7c: libfetch: Reject control characters in credentials

Summary

If a URL contains credentials, check that neither the user name nor the
password contain control characters.

MFC after: 1 week

Diff Detail

Repository

rG FreeBSD src repository

Lint

Lint Not Applicable

Unit

Tests Not Applicable

Event Timeline

des created this revision.Fri, Sep 25, 10:37 AM

Herald added a subscriber: imp. · View Herald TranscriptFri, Sep 25, 10:37 AM

des requested review of this revision.Fri, Sep 25, 10:37 AM

Harbormaster completed remote builds in B77302: Diff 187651.Fri, Sep 25, 10:37 AM

des added a parent revision: D60007: libfetch: Limit response line length.Fri, Sep 25, 10:37 AM

des added a child revision: D60015: libfetch: Correctly free redirect target.

markj added inline comments.Wed, Sep 30, 2:40 PM

lib/libfetch/fetch.c
389	Shouldn't this be iscntrl()? isprint() will reject characters above 0x7f too, I'm not sure if that's desirable here.

use iscntrl() instead of !isprint()

Harbormaster completed remote builds in B77531: Diff 188222.Wed, Sep 30, 4:35 PM

des marked an inline comment as done.Wed, Sep 30, 4:36 PM

The commit log message should explain why.

This revision is now accepted and ready to land.Wed, Sep 30, 4:39 PM

Closed by commit rGb319c3d6ac7c: libfetch: Reject control characters in credentials (authored by des). · Explain WhyWed, Sep 30, 4:56 PM

This revision was automatically updated to reflect the committed changes.

des added a commit: rGb319c3d6ac7c: libfetch: Reject control characters in credentials.

Revision Contents
Changeset List

Path

Size

lib/

libfetch/

fetch.c

8 lines

Diff 188226

View Options

libfetch: Reject control characters in credentialsClosedPublicActions