mirrors/libmicrohttpd
2
0
Fork 0
mirror of https://git.gnunet.org/libmicrohttpd.git synced 2026-09-25 04:09:31 +03:00
Code Issues Packages Projects Releases Wiki Activity

gen_auth: do not allow semicolon for diget auth unless it is in a quoted string

Browse Source 
Also forbid binary zero
This commit is contained in:
Evgeny Grin (Karlson2k)
2022-06-05 12:49:16 +03:00
parent 8a2da6d6a3
commit dbb1222de7
1 changed files with 9 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/microhttpd/gen_auth.c
+9 -2
View File
@@ -187,7 +187,8 @@ parse_dauth_params (const char *str,
('=' == str[i + aparam->tk_name->len]) ||
(' ' == str[i + aparam->tk_name->len]) ||
('\t' == str[i + aparam->tk_name->len]) ||
(',' == str[i + aparam->tk_name->len])) )
(',' == str[i + aparam->tk_name->len]) ||
(';' == str[i + aparam->tk_name->len])) )
{
size_t value_start;
size_t value_len;
@@ -236,6 +237,8 @@ parse_dauth_params (const char *str,
{
if (0 == str[i])
return false; /* Binary zero in parameter value */
if (';' == str[i])
return false; /* Semicolon in parameter value */
i++;
}
value_len = i - value_start;
@@ -263,13 +266,17 @@ parse_dauth_params (const char *str,
/* No matching parameter name */
while (str_len > i && ',' != str[i])
{
if ((0 == str[i]) || (';' == str[i]))
return false; /* Not allowed characters */
if ('"' == str[i])
{ /* Skip quoted part */
i++; /* Advance after the opening quote */
while (str_len > i && '"' != str[i])
{
if (0 == str[i])
return false; /* Binary zero is not allowed */
if ('\\' == str[i])
i++; /* Skip escaped char */
i++; /* Skip escaped char */
i++;
}
if (str_len <= i)