From b67d3ba73e98cba63dc6246ee0da22ea803ec3e8 Mon Sep 17 00:00:00 2001 From: Daniel Stenberg Date: Mon, 31 May 2021 08:59:24 +0200 Subject: curl_url_set: reject spaces in URLs w/o CURLU_ALLOW_SPACE They were never officially allowed and slipped in only due to sloppy parsing. Spaces (ascii 32) should be correctly encoded (to %20) before being part of a URL. The new flag bit CURLU_ALLOW_SPACE when a full URL is set, makes libcurl allow spaces. Updated test 1560 to verify. Closes #7073 --- lib/transfer.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'lib/transfer.c') diff --git a/lib/transfer.c b/lib/transfer.c index 097d38d79..76aa61c47 100644 --- a/lib/transfer.c +++ b/lib/transfer.c @@ -1639,7 +1639,8 @@ CURLcode Curl_follow(struct Curl_easy *data, DEBUGASSERT(data->state.uh); uc = curl_url_set(data->state.uh, CURLUPART_URL, newurl, (type == FOLLOW_FAKE) ? CURLU_NON_SUPPORT_SCHEME : - ((type == FOLLOW_REDIR) ? CURLU_URLENCODE : 0) ); + ((type == FOLLOW_REDIR) ? CURLU_URLENCODE : 0) | + CURLU_ALLOW_SPACE); if(uc) { if(type != FOLLOW_FAKE) return Curl_uc_to_curlcode(uc); -- cgit v1.2.1