Repository navigation
Conversation
An ftp:// URL sent its user name and password raw, so ftp://us%40er:p%3Ass@host/ logged in as "us%40er" while the same userinfo over HTTP Basic or SOCKS5 means "us@er". Split on the first raw colon, as SOCKS5 does, then decode each field. A field that decodes to a control byte is refused: %0D%0A would inject an FTP command, and %00 would cut the name short. The size bound now applies to the decoded length. A stored FTP password holding a literal '%' followed by two hex digits changes meaning; it must now be written %25. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Xavier Roche <roche@httrack.com>
The userinfo field is not NUL-terminated at ':' or '@', so this bound is what keeps an escape inside its field; say so at the guard. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Xavier Roche <roche@httrack.com>
xroche
enabled auto-merge (squash)
November 7, 2026 18:47
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
An
ftp://URL now percent-decodes its user name and password beforeUSERandPASS, as HTTP Basic and SOCKS5 already do. Softp://us%40er:p%3Ass@host/logs in asus@erwith passwordp:ss.A field that decodes to a control byte is refused, because
%0D%0Awould inject an FTP command and%00would cut the name short. A stored password with a literal%must now be written%25.Test 760 reads the login off the wire of a local FTP server. It fails on master, which sends
USER us%40er, and passes here. A mutant that skips the control-byte refusal fails both it and the new-#test=ftp-userpassrows.