From 3cfd89add5551242e3d1b69aadd2c5733db4b96f Mon Sep 17 00:00:00 2001 From: Brad King Date: Wed, 15 Sep 2021 15:00:25 -0400 Subject: [PATCH] cmCurl: Fix file:// URLs with spaces for curl 7.78+ Since curl 7.78, URLs with spaces that are not encoded as `%20` or `+` are now correctly rejected with `CURLUE_MALFORMED_INPUT`. However, CMake has long accepted `file://` URLs with spaces in the path due to curl 7.77 and below accidentally allowing them. Preserve this by explicitly encoding spaces in such URLs before handing them to curl. See also upstream curl commit `b67d3ba73` (curl_url_set: reject spaces in URLs w/o CURLU_ALLOW_SPACE, 2021-05-31, curl-7_78_0~133). --- Source/cmCurl.cxx | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/Source/cmCurl.cxx b/Source/cmCurl.cxx index 7a6568e06e..fa001d2825 100644 --- a/Source/cmCurl.cxx +++ b/Source/cmCurl.cxx @@ -5,9 +5,9 @@ #if !defined(CMAKE_USE_SYSTEM_CURL) && !defined(_WIN32) && \ !defined(__APPLE__) && !defined(CURL_CA_BUNDLE) && !defined(CURL_CA_PATH) # define CMAKE_FIND_CAFILE -# include "cmSystemTools.h" #endif #include "cmStringAlgorithms.h" +#include "cmSystemTools.h" #if defined(_WIN32) # include @@ -110,6 +110,11 @@ std::string cmCurlFixFileURL(std::string url) return url; } + // libcurl 7.77 and below accidentally allowed spaces in URLs in some cases. + // One such case was file:// URLs, which CMake has long accepted as a result. + // Explicitly encode spaces for a URL. + cmSystemTools::ReplaceString(url, " ", "%20"); + #if defined(_WIN32) // libcurl doesn't support file:// urls for unicode filenames on Windows. // Convert string from UTF-8 to ACP if this is a file:// URL.