[svn] Fix escape chars in server response vulnerability. Server response is

[wget] / src / ChangeLog

diff --git a/src/ChangeLog b/src/ChangeLog
index 90a79d4dcd26a6c4960f46c62d2783df93c6de96..762067f029d576c6d0d78629b4807b0d5a885480 100644 (file)
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,55 @@
+2005-03-03  Hrvoje Niksic  <hniksic@xemacs.org>
+
+       * retr.c (retrieve_url): Escape location header.
+
+       * http.c (print_server_response_1): Escape server response when
+       printing it.
+       (gethttp): Escape host name, status message, location header, and
+       content type.
+       (http_loop): Escape error message from server.
+
+       * host.c (lookup_host): Escape host name when printing it.
+
+       * ftp.c (getftp): Escape user name when printing it.
+       (getftp): Escape remote file and directory for printing.
+       (getftp): Escape server listing when printing it.
+       (ftp_retrieve_list): Escape link name and file name.
+       (ftp_retrieve_glob): Escape file name.
+
+       * ftp-basic.c (ftp_response): Escape server response when printing
+       it.
+
+       * cookies.c (parse_set_cookies): Escape the cookie field when
+       printing it.
+       (parse_set_cookies): Escape contents of remote header.
+       (cookie_handle_set_cookie): Escape host name and cookie domain.
+
+       * connect.c (connect_to_ip): Escape the host name.
+
+       * log.c (escnonprint): New function, used for printing strings
+       coming from the server that possibly contain non-ASCII characters.
+       (escnonprint_uri): Ditto.
+
+2005-02-24  Hrvoje Niksic  <hniksic@xemacs.org>
+
+       * ftp.c (getftp): Ditto.
+
+       * http.c (gethttp): When we're not supposed to overwrite files,
+       use fopen_excl to open the file and recompute the file name.
+
+       * log.c (redirect_output): Use unique_create to avoid a race
+       condition.
+
+       * mswindows.c (fake_fork_child): Use unique_create.
+
+       * utils.c (fopen_excl): New function that opens a stdio stream
+       with the O_EXCL flag (where available).
+       (unique_create): New function, like unique_name, but also creating
+       the file and returning a file pointer.
+       (fork_to_background): Use unique_create to create the file
+       immediately to avoid race condition with multiple instances of
+       wget -b.
+
 2005-02-24  Hrvoje Niksic  <hniksic@xemacs.org>
 
        * host.c (lookup_host): Test for AI_ADDRCONFIG directly, instead