diff options
author | Costa Tsaousis <costa@tsaousis.gr> | 2018-10-30 02:35:57 +0200 |
---|---|---|
committer | GitHub <noreply@github.com> | 2018-10-30 02:35:57 +0200 |
commit | 92327c9ec211bd1616315abcb255861b130b97ca (patch) | |
tree | 1d22f965d3c7ccc34458b420579fb6d1e0004b24 /libnetdata/url | |
parent | a35bd00fbf8f2578ec0c660b532e925911191b43 (diff) |
fixed vulnerabilities identified by red4sec.com (#4521)
Diffstat (limited to 'libnetdata/url')
-rw-r--r-- | libnetdata/url/url.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/libnetdata/url/url.c b/libnetdata/url/url.c index 8a96063a03..07a9f8069e 100644 --- a/libnetdata/url/url.c +++ b/libnetdata/url/url.c @@ -60,7 +60,9 @@ char *url_decode_r(char *to, char *url, size_t size) { while(*s && d < e) { if(unlikely(*s == '%')) { if(likely(s[1] && s[2])) { - *d++ = from_hex(s[1]) << 4 | from_hex(s[2]); + char t = from_hex(s[1]) << 4 | from_hex(s[2]); + // avoid HTTP header injection + *d++ = (char)((isprint(t))? t : ' '); s += 2; } } |