diff options
| author | Daniel Stenberg <daniel@haxx.se> | 2021-04-23 16:32:19 +0200 |
|---|---|---|
| committer | Daniel Stenberg <daniel@haxx.se> | 2021-04-26 10:25:03 +0200 |
| commit | 7fdf01f32e8b1f0f89ea7d1086df04749dea415b (patch) | |
| tree | 568d0108774e587afde98d1fff417cf74eb604b1 | |
| parent | f2e1163bc89be3d1675cd0de4d746cc71d28ea43 (diff) | |
| download | curl-7fdf01f32e8b1f0f89ea7d1086df04749dea415b.tar.gz | |
libcurl-security.3: don't try to filter IPv4 hosts based on the URL
Closes #6942
| -rw-r--r-- | docs/libcurl/libcurl-security.3 | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/docs/libcurl/libcurl-security.3 b/docs/libcurl/libcurl-security.3 index 705e2c7ef..b4907ac22 100644 --- a/docs/libcurl/libcurl-security.3 +++ b/docs/libcurl/libcurl-security.3 @@ -5,7 +5,7 @@ .\" * | (__| |_| | _ <| |___ .\" * \___|\___/|_| \_\_____| .\" * -.\" * Copyright (C) 1998 - 2020, Daniel Stenberg, <daniel@haxx.se>, et al. +.\" * Copyright (C) 1998 - 2021, Daniel Stenberg, <daniel@haxx.se>, et al. .\" * .\" * This software is licensed as described in the file COPYING, which .\" * you should have received as part of this distribution. The terms @@ -162,6 +162,12 @@ Allowing your application to connect to local hosts, be it the same machine that runs the application or a machine on the same local network, might be possible to exploit by an attacker who then perhaps can "port-scan" the particular hosts - depending on how the application and servers acts. +.SH "IPv4 Addresses" +Some users might be tempted to filter access to local resources or similar +based on numerical IPv4 addresses used in URLs. This is a bad and error-prone +idea because of the many different ways a numerical IPv4 address can be +specified and libcurl accepts: one to four dot-separated fields using one of +or a mix of decimal, octal or hexadecimal encoding. .SH "IPv6 Addresses" libcurl will normally handle IPv6 addresses transparently and just as easily as IPv4 addresses. That means that a sanitizing function that filters out |