summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorSlávek Banko <slavek.banko@axis.cz>2018-07-26 18:44:37 +0200
committerSlávek Banko <slavek.banko@axis.cz>2018-07-26 18:46:27 +0200
commit22f2dd61d89ed909fcee1f6687e92dd761f4280f (patch)
tree8d9c8286414a093681d6b374abc0c00fb26017ca
parent92a29f00ef97677512d89cf16c2df8ed8af83ed7 (diff)
downloadtdelibs-22f2dd61d89ed909fcee1f6687e92dd761f4280f.tar.gz
tdelibs-22f2dd61d89ed909fcee1f6687e92dd761f4280f.zip
Fix security issue CVE-2017-6410
[taken from RedHat kdelibs patches] Signed-off-by: Slávek Banko <slavek.banko@axis.cz> (cherry picked from commit a3b86c26903ade446ac57afc8c3f8a9c1bd66390)
-rw-r--r--kio/misc/kpac/script.cpp12
1 files changed, 10 insertions, 2 deletions
diff --git a/kio/misc/kpac/script.cpp b/kio/misc/kpac/script.cpp
index 55faef8a1..fa1201382 100644
--- a/kio/misc/kpac/script.cpp
+++ b/kio/misc/kpac/script.cpp
@@ -446,10 +446,18 @@ namespace KPAC
if (!findObj.isValid() || !findObj.implementsCall())
throw Error( "No such function FindProxyForURL" );
+ KURL cleanUrl = url;
+ cleanUrl.setPass(QString());
+ cleanUrl.setUser(QString());
+ if (cleanUrl.protocol().lower() == "https") {
+ cleanUrl.setPath(QString());
+ cleanUrl.setQuery(QString());
+ }
+
Object thisObj;
List args;
- args.append(String(url.url()));
- args.append(String(url.host()));
+ args.append(String(cleanUrl.url()));
+ args.append(String(cleanUrl.host()));
Value retval = findObj.call( exec, thisObj, args );
if ( exec->hadException() ) {