url: do not allow %00 to represent NUL in URLs
There is no reason to allow %00 to terminate a string, so do not allow it. Otherwise, we end up returning arbitrary content in the string (that which is after the %00) which is effectively hidden from callers and can escape sanity checks and validation, and possible be used in tandem with a security vulnerability to introduce a payload. Helped-by: brian m. carlson <sandals@crustytoothpaste.net> Signed-off-by: Matthew DeVore <matvore@google.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Matthew DeVore committed
Jun 4, 2019 at 10:57 UTC
d37dc239a427a367427f9c4fdf12a148ad811968
1 file changed
+1
-1
url.c
+1
-1
@@ -48,7 +48,7 @@ static char *url_decode_internal(const char **query, int len,
48
49
if (c == '%' && (len < 0 || len >= 3)) {
50
int val = hex2chr(q + 1);
51
- if (0 <= val) {
51
+ if (0 < val) {
52
strbuf_addch(out, val);
53
q += 3;
54
len -= 3;