Change #274658
| Category | curl |
| Changed by | Alhuda Khan <al.hudz.k@gmail.com> |
| Changed at | Mon 13 Jul 2026 08:46:45 |
| Repository | https://github.com/curl/curl.git |
| Project | curl |
| Branch | master |
| Revision | 94947509868bab0219945567632b519416b1dfb4 |
Comments
ftp: reject control bytes in ACCT and alternative-to-user A CR or LF in the CURLOPT_FTP_ACCOUNT or CURLOPT_FTP_ALTERNATIVE_TO_USER string split the control-channel command line and smuggled a second FTP command. Reject a byte below 0x20 in both values before the command is built. Closes #22301
Changed files
- lib/ftp.c
- tests/data/Makefile.am
- tests/data/test2115
- tests/data/test2116