diff options
Diffstat (limited to 'apt-pkg/acquire-method.cc')
| -rw-r--r-- | apt-pkg/acquire-method.cc | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/apt-pkg/acquire-method.cc b/apt-pkg/acquire-method.cc index 8934d87a0..834137ae4 100644 --- a/apt-pkg/acquire-method.cc +++ b/apt-pkg/acquire-method.cc @@ -471,6 +471,12 @@ void pkgAcqMethod::Status(const char *Format,...) * the worker will enqueue again later on to the right queue */ void pkgAcqMethod::Redirect(const string &NewURI) { + if (NewURI.find_first_not_of(" !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~") != std::string::npos) + { + _error->Error("SECURITY: URL redirect target contains control characters, rejecting."); + Fail(); + return; + } std::unordered_map<std::string, std::string> fields; try_emplace(fields, "URI", Queue->Uri); try_emplace(fields, "New-URI", NewURI); |