Skip to main content

1. do not assume that URLs will be treated the same cross user-agents.

2. do not assume that IPv4-mapped IPv6-addresses can be written in octal.

Another day. Another security report against #curl we could close.

hackerone.com/reports/2493548


curl disclosed on HackerOne: Incorrect Type Conversion in...

## Summary: Octal Type Handling of Errors in IPv4 Mapped IPv6 Addresses in curl allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many programs that...
HackerOne
#curl
in reply to daniel:// stenberg://

gnu/m43
gnu/m43
• •

> there is no single, fixed, known and established URL syntax to follow.

is rfc3986 not a full specification?

in reply to gnu/m43

daniel:// stenberg://
daniel:// stenberg://
• •

@Mae yes, but you will not find two URL parsers that interpret it the same way or even sticks to the letter of that spec. Since the browsers took off in a different direction we can't really interop on the web if we are strict RFC3986 💔

daniel.haxx.se/docs/URL-intero…

The URL Interop Situation

daniel.haxx.se
@gnu/m43
Unknown parent

daniel:// stenberg://
daniel:// stenberg://
• •
@mondanzo me too. It seems more common now for real humans to get chatgpt help phrasing and writing vulnerability reports.
Unknown parent

daniel:// stenberg://
daniel:// stenberg://
• •
@luc122c I suppose everyone is allowed an opinion...
@Luke Nelson
in reply to daniel:// stenberg://

Richard Levitte
Richard Levitte
• •
Side note: gah! I've always hated the '0' prefix for octal, could we all agree on '0o' instead?
in reply to daniel:// stenberg://

x25519
x25519
• •
nicely handled! Thanks for taking the time to respond to these reports! Its widely underestimated how much time, knowledge and mental effort it takes to deal with these reports on a regular basis.
in reply to x25519

daniel:// stenberg://
daniel:// stenberg://
• •
@vastodon thank you. Yes, it does take a significant amount of time and effort ... but luckily, sometimes we can get more value out of single issues by sharing the lessons with a wider audience after the fact.
@x25519
⇧