From nobody Wed Sep 30 16:55:47 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hw1QD055nz6tq1T for ; Wed, 30 Sep 2026 16:55:48 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hw1QC6Ndbz4k1b for ; Wed, 30 Sep 2026 16:55:47 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1790787347; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=vSmFxCZ5TgcE1SmNJ+lSFkMZ6hdA4bXoFaOPCIICbiA=; b=q/inI9scOuaDZrBbhqo7M0IIR2/jqf5tcsFzGaQkF0Tyj5hjKwH7ymauIZbHV6thpJqQDQ aU0mwcUMvbxe0RiPkQWkQnA+Ax6V9NMPirO7x5i6eEsUdctpiN0+rf2FatROHykJ6xyxDE KqVPKT3kZMD80RcnPp20PF0R7SUs9TstCH8KVkvSa3AHTOk1j2oFwVe0OEOy6MtpNvipdA ktwF6p2mdNzWu1drxk/sO8sRDijTfJ6LnqX8U56616l57Yxfbu0RhyKlovJc1H+l3jsEYj UFstkEtPxyIUimP19FvEtxZw8Q1ytr+dspD5cY92hpDlZ7LznBQtL2VAUdyzQQ== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1790787347; b=k+OR8QJbt62CSHkgEH4B72ZpDQ0wEBsTlcW3+DOgylW5R+9snDYjIwad5v6U121cUTbHyw cM2ZYfcqcQwA09lC/VPJ4Mf0vIM8XYZgSm6mUfrTfLCfrSiUM8A8l66YRUnKA4y3ioD8xt R7RYGjle0LTJ2mPxRU6+kpAFBzqAQrwpCLDrw1P7r/4EiI+GzE2noXUO+NlbWs1deQJwP7 d5qMzpHnjWil3Yolh4BLkTJg5lLwSJGLrUdDBJOLA1JaDOFbi/3Q6Q3kwIWXJeOb5oQv8H 8CODW/3291q28loT+1jSkrx1Fq+zQ+lLLlvXswztFbeKxqsxNb37MevbPAJwrw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1790787347; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=vSmFxCZ5TgcE1SmNJ+lSFkMZ6hdA4bXoFaOPCIICbiA=; b=LhhMUvYH1I+907AWTvIHnQwdzvRSwcAmHUOeCPJ+XwdtOnDFQTT1iq9v7s4CFeRTKixuXb 6u6dp3ml53Ftv/uTZGm9yEpr8G3/9rqeYNHxbxI20fIHzieOrLTB7ewaNRZxebezVixRem 0Qc4ZsEDHP1hMQQbmSZel+zesOVxQrGwUZS59CJfnppUTweGpt/wyodBa2tRGgSt0yowXc 7cT08VyoswDSO0INJtAjcCLL3zxTNqTfdJJ1sW6zPT6k6DKodfQdHDr6d0hYkvofrMk22S W2bipJ64zXgfhrjcboKHI6MABd2RNAekCY6QxvPD85/mXKHtnhGxD6h/BAg6AQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hw1QC5SbSztbk for ; Wed, 30 Sep 2026 16:55:47 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 394db by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Wed, 30 Sep 2026 16:55:47 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Dag-Erling=?utf-8?Q? Sm=C3=B8rg?=rav Subject: git: b319c3d6ac7c - main - libfetch: Reject control characters in credentials List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: des X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: b319c3d6ac7cf408b56fe745f718de6a324ec180 Auto-Submitted: auto-generated Date: Wed, 30 Sep 2026 16:55:47 +0000 Message-Id: <6abd3f13.394db.daddb25@gitrepo.freebsd.org> The branch main has been updated by des: URL: https://cgit.FreeBSD.org/src/commit/?id=b319c3d6ac7cf408b56fe745f718de6a324ec180 commit b319c3d6ac7cf408b56fe745f718de6a324ec180 Author: Dag-Erling Smørgrav AuthorDate: 2026-09-30 16:54:33 +0000 Commit: Dag-Erling Smørgrav CommitDate: 2026-09-30 16:54:33 +0000 libfetch: Reject control characters in credentials If a URL contains credentials, check that neither the user name nor the password contain control characters which might confuse the server, especially in the FTP case. MFC after: 1 week Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D60008 --- lib/libfetch/fetch.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/lib/libfetch/fetch.c b/lib/libfetch/fetch.c index 97fc04bb09a6..dd0603490674 100644 --- a/lib/libfetch/fetch.c +++ b/lib/libfetch/fetch.c @@ -347,7 +347,7 @@ struct url * fetchParseURL(const char *URL) { char *doc; - const char *p, *q; + const char *p, *q, *r; struct url *u; int i, n; @@ -385,12 +385,18 @@ fetchParseURL(const char *URL) q = fetch_pctdecode(u->user, URL, URL_USERLEN); if (q == NULL) goto ouch; + for (r = u->user; *r != '\0'; r++) + if (iscntrl((unsigned char)*r)) + goto ouch; /* password */ if (*q == ':') { q = fetch_pctdecode(u->pwd, q + 1, URL_PWDLEN); if (q == NULL) goto ouch; + for (r = u->pwd; *r != '\0'; r++) + if (iscntrl((unsigned char)*r)) + goto ouch; } p++; } else {