Merge cherrypicks of [2780928, 2780896, 2781450, 2781451, 2781452, 2781453, 2781454, 2781169, 2781470, 2781471, 2781472, 2781473, 2781474, 2780929, 2781185, 2781490, 2781491, 2781492, 2781493, 2781494, 2781495, 2781496, 2781497, 2781437, 2781498, 2781499, 2781500, 2781501, 2781502, 2781503, 2781504, 2781505, 2781506, 2781507, 2780897, 2780898, 2780899, 2780900, 2780901, 2781475, 2781476, 2781477, 2781478, 2781186, 2781511, 2781512, 2781630] into nyc-bugfix-release
Change-Id: Iff92ee230f04da516a550c31b8eee3ee5ff681b0
diff --git a/luni/src/test/java/libcore/java/net/FtpURLConnectionTest.java b/luni/src/test/java/libcore/java/net/FtpURLConnectionTest.java
new file mode 100644
index 0000000..ff5d0b6
--- /dev/null
+++ b/luni/src/test/java/libcore/java/net/FtpURLConnectionTest.java
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package libcore.java.net;
+
+import junit.framework.TestCase;
+
+import java.io.IOException;
+import java.net.URL;
+import java.util.Locale;
+
+/**
+ * Tests URLConnections for ftp:// URLs.
+ */
+public class FtpURLConnectionTest extends TestCase {
+
+ private static final String FILE_PATH = "test/file/for/FtpURLConnectionTest.txt";
+ private static final String USER = "user";
+ private static final String PASSWORD = "password";
+ private static final String SERVER_HOSTNAME = "localhost";
+ private static final String USER_HOME_DIR = "/home/user";
+
+ // http://b/35784677
+ public void testCRLFInUserinfo() throws Exception {
+ int serverPort = 1234;
+ // '/r/n' in the username, no password
+ String url1String = String.format(Locale.US, "ftp://foo%%0D%%0Acommand@%s:%s/%s",
+ SERVER_HOSTNAME, serverPort, FILE_PATH);
+ // '/r/n' in the username with password
+ String url2String = String.format(Locale.US, "ftp://foo%%0D%%0Acommand:foo@%s:%s/%s",
+ SERVER_HOSTNAME, serverPort, FILE_PATH);
+ // '/r/n' in the password
+ String url3String = String.format(Locale.US, "ftp://foo:bar%%0D%%0Acommand@%s:%s/%s",
+ SERVER_HOSTNAME, serverPort, FILE_PATH);
+ // just '/r' in the password
+ String url4String = String.format(Locale.US, "ftp://foo:bar%%0Dcommand@%s:%s/%s",
+ SERVER_HOSTNAME, serverPort, FILE_PATH);
+ // just '/n' in the username
+ String url5String = String.format(Locale.US, "ftp://foo%%0Acommand:bar@%s:%s/%s",
+ SERVER_HOSTNAME, serverPort, FILE_PATH);
+
+ for (String urlString : new String[]{ url1String, url2String, url3String, url4String,
+ url5String }) {
+ try {
+ new URL(urlString).openConnection();
+ fail();
+ } catch(IOException expected) {}
+ }
+ }
+}
diff --git a/ojluni/src/main/java/sun/net/www/protocol/ftp/FtpURLConnection.java b/ojluni/src/main/java/sun/net/www/protocol/ftp/FtpURLConnection.java
index e2b7fa1..fd96343 100755
--- a/ojluni/src/main/java/sun/net/www/protocol/ftp/FtpURLConnection.java
+++ b/ojluni/src/main/java/sun/net/www/protocol/ftp/FtpURLConnection.java
@@ -184,6 +184,12 @@
}
if (userInfo != null) { // get the user and password
+ // Android-changed: Added a test for CR/LF presence in the userInfo
+ if (userInfo.indexOf("\r") != -1 || userInfo.indexOf("\n") != -1) {
+ throw new IOException("<CR> and/or <LF> characters in username and password are"
+ + " not permitted");
+ }
+
int delimiter = userInfo.indexOf(':');
if (delimiter == -1) {
user = ParseUtil.decode(userInfo);
