diff options
-rw-r--r-- | meta/recipes-support/curl/curl/0002-transfer-strip-credentials-from-the-auto-referer-hea.patch | 152 | ||||
-rw-r--r-- | meta/recipes-support/curl/curl_7.75.0.bb | 1 |
2 files changed, 153 insertions, 0 deletions
diff --git a/meta/recipes-support/curl/curl/0002-transfer-strip-credentials-from-the-auto-referer-hea.patch b/meta/recipes-support/curl/curl/0002-transfer-strip-credentials-from-the-auto-referer-hea.patch new file mode 100644 index 0000000000..6c4f6f2f48 --- /dev/null +++ b/meta/recipes-support/curl/curl/0002-transfer-strip-credentials-from-the-auto-referer-hea.patch | |||
@@ -0,0 +1,152 @@ | |||
1 | From 21f6cf63939111d8d76d3a4c07f2cd2fe6cb78f8 Mon Sep 17 00:00:00 2001 | ||
2 | From: Trevor Gamblin <trevor.gamblin@windriver.com> | ||
3 | Date: Tue, 1 Jun 2021 09:59:20 -0400 | ||
4 | Subject: [PATCH 2/2] transfer: strip credentials from the auto-referer header | ||
5 | field | ||
6 | |||
7 | Added test 2081 to verify. | ||
8 | |||
9 | CVE-2021-22876 | ||
10 | |||
11 | Bug: https://curl.se/docs/CVE-2021-22876.html | ||
12 | |||
13 | Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com> | ||
14 | --- | ||
15 | lib/transfer.c | 25 ++++++++++++++-- | ||
16 | tests/data/Makefile.inc | 2 +- | ||
17 | tests/data/test2081 | 66 +++++++++++++++++++++++++++++++++++++++++ | ||
18 | 3 files changed, 90 insertions(+), 3 deletions(-) | ||
19 | create mode 100644 tests/data/test2081 | ||
20 | |||
21 | diff --git a/lib/transfer.c b/lib/transfer.c | ||
22 | index 2f29b29d8..c641a1d47 100644 | ||
23 | --- a/lib/transfer.c | ||
24 | +++ b/lib/transfer.c | ||
25 | @@ -1565,6 +1565,9 @@ CURLcode Curl_follow(struct Curl_easy *data, | ||
26 | data->set.followlocation++; /* count location-followers */ | ||
27 | |||
28 | if(data->set.http_auto_referer) { | ||
29 | + CURLU *u; | ||
30 | + char *referer; | ||
31 | + | ||
32 | /* We are asked to automatically set the previous URL as the referer | ||
33 | when we get the next URL. We pick the ->url field, which may or may | ||
34 | not be 100% correct */ | ||
35 | @@ -1574,9 +1577,27 @@ CURLcode Curl_follow(struct Curl_easy *data, | ||
36 | data->change.referer_alloc = FALSE; | ||
37 | } | ||
38 | |||
39 | - data->change.referer = strdup(data->change.url); | ||
40 | - if(!data->change.referer) | ||
41 | + /* Make a copy of the URL without crenditals and fragment */ | ||
42 | + u = curl_url(); | ||
43 | + if(!u) | ||
44 | + return CURLE_OUT_OF_MEMORY; | ||
45 | + | ||
46 | + uc = curl_url_set(u, CURLUPART_URL, data->change.url, 0); | ||
47 | + if(!uc) | ||
48 | + uc = curl_url_set(u, CURLUPART_FRAGMENT, NULL, 0); | ||
49 | + if(!uc) | ||
50 | + uc = curl_url_set(u, CURLUPART_USER, NULL, 0); | ||
51 | + if(!uc) | ||
52 | + uc = curl_url_set(u, CURLUPART_PASSWORD, NULL, 0); | ||
53 | + if(!uc) | ||
54 | + uc = curl_url_get(u, CURLUPART_URL, &referer, 0); | ||
55 | + | ||
56 | + curl_url_cleanup(u); | ||
57 | + | ||
58 | + if(uc || referer == NULL) | ||
59 | return CURLE_OUT_OF_MEMORY; | ||
60 | + | ||
61 | + data->change.referer = referer; | ||
62 | data->change.referer_alloc = TRUE; /* yes, free this later */ | ||
63 | } | ||
64 | } | ||
65 | diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc | ||
66 | index 5ebf049b8..e08cfc7ee 100644 | ||
67 | --- a/tests/data/Makefile.inc | ||
68 | +++ b/tests/data/Makefile.inc | ||
69 | @@ -223,7 +223,7 @@ test2064 test2065 test2066 test2067 test2068 test2069 \ | ||
70 | test2064 test2065 test2066 test2067 test2068 test2069 test2070 \ | ||
71 | test2071 test2072 test2073 test2074 test2075 test2076 test2077 \ | ||
72 | test2078 \ | ||
73 | -test2080 \ | ||
74 | +test2080 test2081\ | ||
75 | test2100 \ | ||
76 | \ | ||
77 | test3000 test3001 test3002 test3003 test3004 test3005 test3006 test3007 \ | ||
78 | diff --git a/tests/data/test2081 b/tests/data/test2081 | ||
79 | new file mode 100644 | ||
80 | index 000000000..7e74f5766 | ||
81 | --- /dev/null | ||
82 | +++ b/tests/data/test2081 | ||
83 | @@ -0,0 +1,66 @@ | ||
84 | +<testcase> | ||
85 | +<info> | ||
86 | +<keywords> | ||
87 | +HTTP | ||
88 | +HTTP GET | ||
89 | +referer | ||
90 | +followlocation | ||
91 | +--write-out | ||
92 | +</keywords> | ||
93 | +</info> | ||
94 | + | ||
95 | +# Server-side | ||
96 | +<reply> | ||
97 | +<data nocheck="yes"> | ||
98 | +HTTP/1.1 301 This is a weirdo text message swsclose | ||
99 | +Location: data/%TESTNUMBER0002.txt?coolsite=yes | ||
100 | +Content-Length: 62 | ||
101 | +Connection: close | ||
102 | + | ||
103 | +This server reply is for testing a simple Location: following | ||
104 | +</data> | ||
105 | +</reply> | ||
106 | + | ||
107 | +# Client-side | ||
108 | +<client> | ||
109 | +<server> | ||
110 | +http | ||
111 | +</server> | ||
112 | + <name> | ||
113 | +Automatic referrer credential and anchor stripping check | ||
114 | + </name> | ||
115 | + <command> | ||
116 | +http://user:pass@%HOSTIP:%HTTPPORT/we/want/our/%TESTNUMBER#anchor --location --referer ';auto' --write-out '%{referer}\n' | ||
117 | +</command> | ||
118 | +</client> | ||
119 | + | ||
120 | +# Verify data after the test has been "shot" | ||
121 | +<verify> | ||
122 | +<errorcode> | ||
123 | +52 | ||
124 | +</errorcode> | ||
125 | +<protocol> | ||
126 | +GET /we/want/our/%TESTNUMBER HTTP/1.1 | ||
127 | +Host: %HOSTIP:%HTTPPORT | ||
128 | +Authorization: Basic dXNlcjpwYXNz | ||
129 | +User-Agent: curl/%VERSION | ||
130 | +Accept: */* | ||
131 | + | ||
132 | +GET /we/want/our/data/%TESTNUMBER0002.txt?coolsite=yes HTTP/1.1 | ||
133 | +Host: %HOSTIP:%HTTPPORT | ||
134 | +Authorization: Basic dXNlcjpwYXNz | ||
135 | +User-Agent: curl/%VERSION | ||
136 | +Accept: */* | ||
137 | +Referer: http://%HOSTIP:%HTTPPORT/we/want/our/%TESTNUMBER | ||
138 | + | ||
139 | +</protocol> | ||
140 | +<stdout> | ||
141 | +HTTP/1.1 301 This is a weirdo text message swsclose | ||
142 | +Location: data/%TESTNUMBER0002.txt?coolsite=yes | ||
143 | +Content-Length: 62 | ||
144 | +Connection: close | ||
145 | + | ||
146 | +http://%HOSTIP:%HTTPPORT/we/want/our/%TESTNUMBER | ||
147 | +</stdout> | ||
148 | +</verify> | ||
149 | +</testcase> | ||
150 | -- | ||
151 | 2.31.1 | ||
152 | |||
diff --git a/meta/recipes-support/curl/curl_7.75.0.bb b/meta/recipes-support/curl/curl_7.75.0.bb index 428b8cd9e3..7c7b363ae3 100644 --- a/meta/recipes-support/curl/curl_7.75.0.bb +++ b/meta/recipes-support/curl/curl_7.75.0.bb | |||
@@ -12,6 +12,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=425f6fdc767cc067518eef9bbdf4ab7b" | |||
12 | SRC_URI = "https://curl.haxx.se/download/curl-${PV}.tar.bz2 \ | 12 | SRC_URI = "https://curl.haxx.se/download/curl-${PV}.tar.bz2 \ |
13 | file://0001-replace-krb5-config-with-pkg-config.patch \ | 13 | file://0001-replace-krb5-config-with-pkg-config.patch \ |
14 | file://0001-vtls-add-isproxy-argument-to-Curl_ssl_get-addsession.patch \ | 14 | file://0001-vtls-add-isproxy-argument-to-Curl_ssl_get-addsession.patch \ |
15 | file://0002-transfer-strip-credentials-from-the-auto-referer-hea.patch \ | ||
15 | " | 16 | " |
16 | 17 | ||
17 | SRC_URI[sha256sum] = "50552d4501c178e4cc68baaecc487f466a3d6d19bbf4e50a01869effb316d026" | 18 | SRC_URI[sha256sum] = "50552d4501c178e4cc68baaecc487f466a3d6d19bbf4e50a01869effb316d026" |