curl/tests/data/test340

<testcase>
<info>
<keywords>
FTP
PASV
CWD
--ftp-method
singlecwd
</keywords>
</info>
#
# Server-side
<reply>
</reply>

# Client-side
<client>
<server>
ftp
</server>
 <name>
FTP using %00 in path with singlecwd
 </name>
 <command>
--ftp-method singlecwd ftp://%HOSTIP:%FTPPORT/%00first/second/third/%TESTNUMBER
</command>
</client>

# Verify data after the test has been "shot"
<verify>
<protocol>
USER anonymous
PASS ftp@example.com
PWD
</protocol>
<errorcode>
3
</errorcode>
</verify>
</testcase>
FTP: reject path components with control codes Refuse to operate when given path components featuring byte values lower than 32. Previously, inserting a %00 sequence early in the directory part when using the 'singlecwd' ftp method could make curl write a zero byte outside of the allocated buffer. Test case 340 verifies. CVE-2018-1000120 Reported-by: Duy Phan Thanh Bug: https://curl.haxx.se/docs/adv_2018-9cd6.html 2018-01-31 15:40:11 +08:00			`<testcase>`
			`<info>`
			`<keywords>`
			`FTP`
			`PASV`
			`CWD`
			`--ftp-method`
			`singlecwd`
			`</keywords>`
			`</info>`
			`#`
			`# Server-side`
			`<reply>`
			`</reply>`

			`# Client-side`
			`<client>`
			`<server>`
			`ftp`
			`</server>`
			`<name>`
			`FTP using %00 in path with singlecwd`
			`</name>`
			`<command>`
tests: use %TESTNUMBER instead of fixed number This makes the tests easier to copy and relocate to other test numbers without having to update content. Closes #6738 2021-03-13 00:38:26 +08:00			`--ftp-method singlecwd ftp://%HOSTIP:%FTPPORT/%00first/second/third/%TESTNUMBER`
FTP: reject path components with control codes Refuse to operate when given path components featuring byte values lower than 32. Previously, inserting a %00 sequence early in the directory part when using the 'singlecwd' ftp method could make curl write a zero byte outside of the allocated buffer. Test case 340 verifies. CVE-2018-1000120 Reported-by: Duy Phan Thanh Bug: https://curl.haxx.se/docs/adv_2018-9cd6.html 2018-01-31 15:40:11 +08:00			`</command>`
			`</client>`

			`# Verify data after the test has been "shot"`
			`<verify>`
			`<protocol>`
			`USER anonymous`
			`PASS ftp@example.com`
			`PWD`
			`</protocol>`
			`<errorcode>`
			`3`
			`</errorcode>`
			`</verify>`
			`</testcase>`