Builder curl-ares-solaris11-sparc Build #5479

Results:

Build successful

SourceStamp:

BuildSlave:

Reason:

The SingleBranchScheduler scheduler named 'schedule-curl-ares-solaris11-sparc' triggered this build

Steps and Logfiles:

1. git update ( 6 secs )
   1. stdio
2. Runtest './tests/testcurl.pl --nogitpull ...' ( 22 mins, 24 secs )
   1. stdio
   2. resultlog
3. Mail result 'cat resultlog ...' ( 1 secs )
   1. stdio

Build Properties:

Forced Build Properties:

Responsible Users:

1. Daniel Stenberg

   danielohnoyoudont@haxx.se
2. Ercan Ermis

   epostaohnoyoudont@ercanermis.com
3. Viktor Szakats

   commitohnoyoudont@vsz.me

Timing:

All Changes:

:

1. Change #261434

   Category	curl
   Changed by	Daniel Stenberg <danielohnoyoudont@haxx.se>
   Changed at	Wed 18 Mar 2026 11:14:20
   Repository	https://github.com/curl/curl.git
   Project	curl
   Branch	master
   Revision	3f06e27502d616e42e28e3545d2624571a561421

   Comments

   urlapi: make dedotdotify handle leading dots correctly
   Paths starting with one or two leading dots but without a following
   slash were not handled correctly.
   
   Follow-up to c31dd6631f9a0177aa9045cdbb
   
   Extended test 1395 accordingly with a set of new test string.
   
   Reported by Codex Security
   
   Closes #20974

   Changed files

   • lib/urlapi.c
   • tests/unit/unit1395.c

2. Change #261435

   Category	curl
   Changed by	Viktor Szakats <commitohnoyoudont@vsz.me>
   Changed at	Wed 18 Mar 2026 11:22:23
   Repository	https://github.com/curl/curl.git
   Project	curl
   Branch	master
   Revision	650b33a3dbcb6a48dc52f735401bb75f52bc3121

   Comments

   badwords: pass config as filename arg
   Instead of stdin.
   
   To simplify the command-line, and allow using a safe and portable
   `system()` call from `badwords-all`.
   
   Ref: https://perldoc.perl.org/functions/system
   
   Closes #20970

   Changed files

   • scripts/badwords
   • scripts/badwords-all

3. Change #261436

   Category	curl
   Changed by	Ercan Ermis <epostaohnoyoudont@ercanermis.com>
   Changed at	Wed 18 Mar 2026 11:24:41
   Repository	https://github.com/curl/curl.git
   Project	curl
   Branch	master
   Revision	c3f04e76ae2b1c3ee9283010538769d54a878a59

   Comments

   ftp: reject PWD responses containing control characters
   A malicious or compromised FTP server could include control characters
   (e.g. bare \r, or bytes 0x01-0x1f/0x7f) inside the quoted directory path
   of its 257 PWD response. That string is stored verbatim as
   ftpc->entrypath and later sent unescaped in a CWD command on connection
   reuse via Curl_pp_sendf(), which performs no sanitization before
   appending \r\n.
   
   Reject the entire path if any control character is encountered during
   extraction so that tainted data never reaches a subsequent FTP command.
   
   Add test case 3217 and 3218 to verify. Adjusted test 1152 accordingly.
   
   Closes #20949

   Changed files

   • lib/ftp.c
   • tests/data/Makefile.am
   • tests/data/test1152
   • tests/data/test3217
   • tests/data/test3218