Skip to content

Commit c6f250c

Browse files
committed
redirect: when following redirects to an absolute URL, URL encode it
... to make it handle for example (RFC violating) embeded spaces. Reported-by: momala454 on github Fixes #4445 Closes #4447
1 parent 2c20109 commit c6f250c

File tree

3 files changed

+78
-1
lines changed

3 files changed

+78
-1
lines changed

lib/transfer.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1591,7 +1591,8 @@ CURLcode Curl_follow(struct Curl_easy *data,
15911591

15921592
DEBUGASSERT(data->state.uh);
15931593
uc = curl_url_set(data->state.uh, CURLUPART_URL, newurl,
1594-
(type == FOLLOW_FAKE) ? CURLU_NON_SUPPORT_SCHEME : 0);
1594+
(type == FOLLOW_FAKE) ? CURLU_NON_SUPPORT_SCHEME :
1595+
((type == FOLLOW_REDIR) ? CURLU_URLENCODE : 0) );
15951596
if(uc) {
15961597
if(type != FOLLOW_FAKE)
15971598
return Curl_uc_to_curlcode(uc);

tests/data/Makefile.inc

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,7 @@ test626 test627 test628 test629 test630 test631 test632 test633 test634 \
8484
test635 test636 test637 test638 test639 test640 test641 test642 \
8585
test643 test644 test645 test646 test647 test648 test649 test650 test651 \
8686
test652 test653 test654 test655 test656 test658 test659 test660 test661 \
87+
test662 \
8788
\
8889
test700 test701 test702 test703 test704 test705 test706 test707 test708 \
8990
test709 test710 test711 test712 test713 test714 test715 test716 test717 \

tests/data/test662

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
<testcase>
2+
<info>
3+
<keywords>
4+
HTTP
5+
HTTP GET
6+
followlocation
7+
</keywords>
8+
</info>
9+
#
10+
# Server-side
11+
<reply>
12+
<data>
13+
HTTP/1.1 302 OK
14+
Location: http://example.net/tes t case=/6620002
15+
Date: Thu, 09 Nov 2010 14:49:00 GMT
16+
Content-Length: 0
17+
18+
</data>
19+
<data2>
20+
HTTP/1.1 200 OK
21+
Location: this should be ignored
22+
Date: Thu, 09 Nov 2010 14:49:00 GMT
23+
Content-Length: 5
24+
25+
body
26+
</data2>
27+
<datacheck>
28+
HTTP/1.1 302 OK
29+
Location: http://example.net/tes t case=/6620002
30+
Date: Thu, 09 Nov 2010 14:49:00 GMT
31+
Content-Length: 0
32+
33+
HTTP/1.1 200 OK
34+
Location: this should be ignored
35+
Date: Thu, 09 Nov 2010 14:49:00 GMT
36+
Content-Length: 5
37+
38+
body
39+
</datacheck>
40+
</reply>
41+
42+
#
43+
# Client-side
44+
<client>
45+
<server>
46+
http
47+
</server>
48+
<name>
49+
HTTP redirect with whitespace in absolute Location: URL
50+
</name>
51+
<command>
52+
http://example.com/please/gimme/662 -L -x http://%HOSTIP:%HTTPPORT
53+
</command>
54+
</client>
55+
56+
#
57+
# Verify data after the test has been "shot"
58+
<verify>
59+
<strip>
60+
^User-Agent:.*
61+
</strip>
62+
<protocol>
63+
GET http://example.com/please/gimme/662 HTTP/1.1
64+
Host: example.com
65+
Accept: */*
66+
Proxy-Connection: Keep-Alive
67+
68+
GET http://example.net/tes%20t%20case=/6620002 HTTP/1.1
69+
Host: example.net
70+
Accept: */*
71+
Proxy-Connection: Keep-Alive
72+
73+
</protocol>
74+
</verify>
75+
</testcase>

0 commit comments

Comments
 (0)