Hi,

Using ftp(1) with HTTP(S) scheme and Basic auth, it is currently not
possible to have username (or password) with a '@' inner.

For example, this URI is badly parsed:
ftp https://mym...@example.com:my-passw...@another-domain.example.com/blabla

According to RFC2617, '@' is a valid character in user-id or password:
  user-pass   = userid ":" password
  userid      = *<TEXT excluding ":">
  password    = *TEXT

Here a patch to search the last '@' in the string (which don't contains
the path at this time).

-- 
Sébastien Marie

Index: fetch.c
===================================================================
RCS file: /cvs/src/usr.bin/ftp/fetch.c,v
retrieving revision 1.122
diff -u -p -r1.122 fetch.c
--- fetch.c     20 May 2014 01:25:23 -0000      1.122
+++ fetch.c     23 Jun 2014 07:46:33 -0000
@@ -474,7 +474,7 @@ noslash:
         */
        if (proxyenv == NULL &&
            (!strcmp(scheme, HTTP_URL) || !strcmp(scheme, HTTPS_URL))) {
-               if ((p = strchr(host, '@')) != NULL) {
+               if ((p = strrchr(host, '@')) != NULL) {
                        size_t authlen = (strlen(host) + 5) * 4 / 3;
                        *p = 0; /* Kill @ */
                        if ((auth = malloc(authlen)) == NULL)

Reply via email to