Issue 41040 - FTP UCP: Prolems with bad data in URLs
Summary: FTP UCP: Prolems with bad data in URLs
Status: ACCEPTED
Alias: None
Product: ucb
Classification: Code
Component: code (show other issues)
Version: 680m72
Hardware: All All
: P3 Trivial (vote)
Target Milestone: AOO PleaseHelp
Assignee: AOO issues mailing list
QA Contact:
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2005-01-20 15:45 UTC by Stephan Bergmann
Modified: 2013-02-07 22:05 UTC (History)
1 user (show)

See Also:
Issue Type: DEFECT
Latest Confirmation in: ---
Developer Difficulty: ---


Attachments

Note You need to log in before you can comment on or make changes to this issue.
Description Stephan Bergmann 2005-01-20 15:45:22 UTC
The FTP UCP does not detect and reject URLs that contain NULL
(U+0000), LF (U+000A), and CR (U+000D), either unescaped or escaped as %00, %0A,
%0D, etc.  When "ftp://host/path" is a working
URL, calling XContent.execute("getPropertyValues") to retrieve the "Size"
property on contents corresponding to the following URLs has the following
results (all string literals are in Java notation):

"ftp://host/path": success
"ftp://host/path\u0000foo": success (error: "\u0000foo" is silently dropped on
client side)
"ftp://host/path%00foo": success (error: "\u0000foo" is silently dropped on
client side)
"http://host/path\r\nfoo": success (error: garbage is sent from client to server)
"http://host/path%0D%0Afoo": com.sun.star.ucb.InteractiveAugmentedIOException ""
(error: garbage is sent from client to server)

On fixing the last three cases, see the thread at
<http://curl.haxx.se/mail/lib-2005-01/0172.html>.

Also, inspecting ucb/source/ucp/ftp/ftpurl.cxx 1.18, all code that use
curl_slist_append should ensure that it compose well-formed FTP commands (i.e.,
containing valid RFC 959 <string>s).
Comment 1 andreas.bille 2006-06-16 14:55:19 UTC
accepted
Comment 2 andreas.bille 2007-04-03 15:52:14 UTC
ABI->KSO: As discussed ...
Comment 3 kai.sommerfeld 2007-04-05 08:33:42 UTC
.
Comment 4 kai.sommerfeld 2007-08-15 12:38:57 UTC
KSO->TKR: Please take care of this issue.
Comment 5 tkr 2007-08-20 09:49:42 UTC
.