File properly-re-implement-userinfo-parsing.patch of Package wget.34428

Overview Repositories Revisions Requests Users Attributes Meta

File properly-re-implement-userinfo-parsing.patch of Package wget.34428

diff -Ppdru wget-1.14/src/url.c wget-1.14-new/src/url.c
--- wget-1.14/src/url.c	2024-06-18 17:56:48.195875455 +0200
+++ wget-1.14-new/src/url.c	2024-06-18 17:59:34.007444479 +0200
@@ -41,6 +41,7 @@ as that of the covered work.  */
 #include "utils.h"
 #include "url.h"
 #include "host.h"  /* for is_valid_ipv6_address */
+#include "c-ctype.h"
 
 #ifdef __VMS
 #include "vms.h"
@@ -490,12 +491,39 @@ scheme_disable (enum url_scheme scheme)
 static const char *
 url_skip_credentials (const char *url)
 {
-  /* Look for '@' that comes before terminators, such as '/', '?',
-     '#', or ';'.  */
-  const char *p = (const char *)strpbrk (url, "@/?#;");
-  if (!p || *p != '@')
-    return url;
-  return p + 1;
+  /*
+   * This whole file implements https://www.rfc-editor.org/rfc/rfc2396 .
+   * RFC 2396 is outdated since 2005 and needs a rewrite or a thorough re-visit.
+   *
+   * The RFC says
+   * server        = [ [ userinfo "@" ] hostport ]
+   * userinfo      = *( unreserved | escaped | ";" | ":" | "&" | "=" | "+" | "$" | "," )
+   * unreserved    = alphanum | mark
+   * mark          = "-" | "_" | "." | "!" | "~" | "*" | "'" | "(" | ")"
+   */
+  static const char *allowed = "-_.!~*'();:&=+$,";
+  const char *p;
+  for (p = url; *p; p++)
+    {
+      if (c_isalnum(*p))
+        continue;
+
+      if (strchr(allowed, *p))
+        continue;
+
+      if (*p == '%' && c_isxdigit(p[1]) && c_isxdigit(p[2]))
+        {
+          p += 2;
+          continue;
+        }
+
+      if (*p == '@')
+        return p + 1;
+
+      break;
+    }
+
+  return url;
 }
 
 /* Parse credentials contained in [BEG, END).  The region is expected

Places

File properly-re-implement-userinfo-parsing.patch of Package wget.34428

Places