Reject ftp URLConnection containing /r/n in user info. Test: In change 8a4a28d8710a137720fe9044b1c158bde1bee372 Bug: 35784677 Change-Id: Ie5084a06918b1767b3cd1bec49667b17ddc97aeb (cherry picked from commit 6e0600543f9a81bc94b8d9d25b13456798c7fbec)
diff --git a/ojluni/src/main/java/sun/net/www/protocol/ftp/FtpURLConnection.java b/ojluni/src/main/java/sun/net/www/protocol/ftp/FtpURLConnection.java index e2b7fa1..fd96343 100755 --- a/ojluni/src/main/java/sun/net/www/protocol/ftp/FtpURLConnection.java +++ b/ojluni/src/main/java/sun/net/www/protocol/ftp/FtpURLConnection.java
@@ -184,6 +184,12 @@ } if (userInfo != null) { // get the user and password + // Android-changed: Added a test for CR/LF presence in the userInfo + if (userInfo.indexOf("\r") != -1 || userInfo.indexOf("\n") != -1) { + throw new IOException("<CR> and/or <LF> characters in username and password are" + + " not permitted"); + } + int delimiter = userInfo.indexOf(':'); if (delimiter == -1) { user = ParseUtil.decode(userInfo);