commit a199e2fc2a37b605d310f8fb728c2be67b395075
author Przemyslaw Szczepaniak <pszczepaniak@google.com> Mon Mar 27 13:19:35 2017 +0100
committer android-build-team Robot <android-build-team-robot@google.com> Wed Aug 23 19:21:51 2017 +0000
tree eb48e608e703ab3065f73640c43c8068808b22f2
parent 7925afaeee5c3de8e1577241dcdc9cfd620a6d20

Reject ftp URLConnection containing /r/n in user info.

Test: In change 8a4a28d8710a137720fe9044b1c158bde1bee372
Bug: 35784677
Change-Id: Ie5084a06918b1767b3cd1bec49667b17ddc97aeb
(cherry picked from commit 6e0600543f9a81bc94b8d9d25b13456798c7fbec)

ojluni/src/main/java/sun/net/www/protocol/ftp/FtpURLConnection.java

diff --git a/ojluni/src/main/java/sun/net/www/protocol/ftp/FtpURLConnection.java b/ojluni/src/main/java/sun/net/www/protocol/ftp/FtpURLConnection.java
index e2b7fa1..fd96343 100755
--- a/ojluni/src/main/java/sun/net/www/protocol/ftp/FtpURLConnection.java
+++ b/ojluni/src/main/java/sun/net/www/protocol/ftp/FtpURLConnection.java
@@ -184,6 +184,12 @@
         }
 
         if (userInfo != null) { // get the user and password
+            // Android-changed: Added a test for CR/LF presence in the userInfo
+            if (userInfo.indexOf("\r") != -1 || userInfo.indexOf("\n") != -1) {
+                throw new IOException("<CR> and/or <LF> characters in username and password are"
+                        + " not permitted");
+            }
+
             int delimiter = userInfo.indexOf(':');
             if (delimiter == -1) {
                 user = ParseUtil.decode(userInfo);