diff --git a/backport-curl_path-bring-back-support-for-SFTP-path-ending-in.patch b/backport-curl_path-bring-back-support-for-SFTP-path-ending-in.patch new file mode 100644 index 0000000000000000000000000000000000000000..030a29c49b586e04d5dc08fe243d4438e3447f84 --- /dev/null +++ b/backport-curl_path-bring-back-support-for-SFTP-path-ending-in.patch @@ -0,0 +1,71 @@ +From 91b53efa4b6854dc3688f55bfb329b0cafcf5325 Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg +Date: Tue, 25 Apr 2023 13:06:01 +0200 +Subject: [PATCH] curl_path: bring back support for SFTP path ending in /~ + +libcurl used to do a directory listing for this case (even though the +documentation says a URL needs to end in a slash for this), but +4e2b52b5f7a3 modified the behavior. + +This change brings back a directory listing for SFTP paths that are +specified exactly as /~ in the URL. + +Reported-by: Pavel Mayorov +Fixes #11001 +Closes #11023 + +Conflict: context adapt +Reference: https://github.com/curl/curl/commit/91b53efa4b6854dc3688f55bfb329b0cafcf5325 +--- + lib/curl_path.c | 31 +++++++++++++++++-------------- + 1 file changed, 17 insertions(+), 14 deletions(-) + +diff --git a/lib/curl_path.c b/lib/curl_path.c +index fe8cc4f..50f3669 100644 +--- a/lib/curl_path.c ++++ b/lib/curl_path.c +@@ -61,24 +61,27 @@ CURLcode Curl_getworkingpath(struct connectdata *conn, + } + } + else if((conn->handler->protocol & CURLPROTO_SFTP) && +- (working_path_len > 2) && !memcmp(working_path, "/~/", 3)) { +- size_t len; +- const char *p; +- int copyfrom = 3; ++ (!strcmp("/~", working_path) || ++ ((working_path_len > 2) && !memcmp(working_path, "/~/", 3)))) { + if(Curl_dyn_add(&npath, homedir)) { + free(working_path); + return CURLE_OUT_OF_MEMORY; + } +- /* Copy a separating '/' if homedir does not end with one */ +- len = Curl_dyn_len(&npath); +- p = Curl_dyn_ptr(&npath); +- if(len && (p[len-1] != '/')) +- copyfrom = 2; +- +- if(Curl_dyn_addn(&npath, +- &working_path[copyfrom], working_path_len - copyfrom)) { +- free(working_path); +- return CURLE_OUT_OF_MEMORY; ++ if(working_path_len > 2) { ++ size_t len; ++ const char *p; ++ int copyfrom = 3; ++ /* Copy a separating '/' if homedir does not end with one */ ++ len = Curl_dyn_len(&npath); ++ p = Curl_dyn_ptr(&npath); ++ if(len && (p[len-1] != '/')) ++ copyfrom = 2; ++ ++ if(Curl_dyn_addn(&npath, ++ &working_path[copyfrom], working_path_len - copyfrom)) { ++ free(working_path); ++ return CURLE_OUT_OF_MEMORY; ++ } + } + } + +-- +2.33.0 + diff --git a/backport-curl_path-make-SFTP-handle-a-path-like-properly.patch b/backport-curl_path-make-SFTP-handle-a-path-like-properly.patch new file mode 100644 index 0000000000000000000000000000000000000000..048786c12421d6cf32b7271faceff55d1cff9968 --- /dev/null +++ b/backport-curl_path-make-SFTP-handle-a-path-like-properly.patch @@ -0,0 +1,34 @@ +From 0ede81dcc61844cecce8904fb4de24319afeb024 Mon Sep 17 00:00:00 2001 +From: Carlos Henrique Lima Melara +Date: Thu, 5 Jun 2025 14:29:06 +0200 +Subject: [PATCH] curl_path: make SFTP handle a path like /~ properly. + +... without a trailing slash. + +Fixes #17534 +Closes #17542 + +Conflict: lib/vssh/curl_path.c => lib/curl_path.c +curlx_dyn* => Curl_dyn* +Reference: https://github.com/curl/curl/commit/0ede81dcc61844cecce8904fb4de24319afeb024 +--- + lib/curl_path.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/lib/curl_path.c b/lib/curl_path.c +index 117d2e6009f6..474a5ecb8e27 100644 +--- a/lib/curl_path.c ++++ b/lib/curl_path.c +@@ -84,6 +84,12 @@ CURLcode Curl_getworkingpath(struct Curl_easy *data, + return CURLE_OUT_OF_MEMORY; + } + } ++ else { ++ if(Curl_dyn_add(&npath, "/")) { ++ free(working_path); ++ return CURLE_OUT_OF_MEMORY; ++ } ++ } + } + + if(Curl_dyn_len(&npath)) { diff --git a/curl.spec b/curl.spec index 3e679b25962df8c28a75cd733d0fbf3aaba56af4..588a994a3aab482cde20c4bf7ab124216ffe3794 100644 --- a/curl.spec +++ b/curl.spec @@ -6,7 +6,7 @@ Name: curl Version: 7.71.1 -Release: 41 +Release: 42 Summary: Curl is used in command lines or scripts to transfer data License: MIT URL: https://curl.haxx.se/ @@ -92,6 +92,8 @@ Patch179: backport-CVE-2025-0725.patch Patch180: backport-altsvc-avoid-integer-overflow-in-expire-calculation.patch Patch181: backport-test391-verify-path-as-is-with-redirect.patch Patch182: backport-urlapi-fix-redirect-to-a-new-fragment-or-query-only-adapt.patch +Patch183: backport-curl_path-bring-back-support-for-SFTP-path-ending-in.patch +Patch184: backport-curl_path-make-SFTP-handle-a-path-like-properly.patch BuildRequires: automake brotli-devel coreutils gcc groff krb5-devel BuildRequires: libidn2-devel libnghttp2-devel libpsl-devel @@ -256,6 +258,13 @@ rm -rf ${RPM_BUILD_ROOT}%{_libdir}/libcurl.la %{_mandir}/man3/* %changelog +* Mon Jul 28 2025 xinghe - 7.71.1-42 +- Type:bugfix +- CVE:NA +- SUG:NA +- DESC:curl_path: bring back support for SFTP path ending in /~ + curl_path: make SFTP handle a path like /~ properly + * Thu Mar 27 2025 xingwei - 7.71.1-41 - Type:bugfix - CVE:NA