exchange

commit 69e4218beaef5b7ea8bbcef8742e95333e1a21f8
parent fb18f4badf05f4c23a42e7eb542e8da9265e0c79
Author: Christian Grothoff <grothoff@gnunet.org>
Date:   Sat, 15 Aug 2026 21:25:17 +0200

apply percent-encoding on untrusted inputs in URI construction

Diffstat:
M
src/kyclogic/plugin_kyclogic_kycaid.c
 | 
12
+++++++++---
M
src/kyclogic/plugin_kyclogic_oauth2.c
 | 
14
++++++++++----
M
src/kyclogic/plugin_kyclogic_persona.c
 | 
42
+++++++++++++++++++++++++++++++-----------

3 files changed, 50 insertions(+), 18 deletions(-)
diff --git a/src/kyclogic/plugin_kyclogic_kycaid.c b/src/kyclogic/plugin_kyclogic_kycaid.c
@@ -1480,9 +1480,15 @@ kycaid_webhook (void *cls,
     return wh;
   }
 
-  GNUNET_asprintf (&wh->url,
-                   "https://api.kycaid.com/applicants/%s",
-                   applicant_id);
+  {
+    char *applicant_id_encoded;
+
+    applicant_id_encoded = TALER_urlencode (applicant_id);
+    GNUNET_asprintf (&wh->url,
+                     "https://api.kycaid.com/applicants/%s",
+                     applicant_id_encoded);
+    GNUNET_free (applicant_id_encoded);
+  }
   GNUNET_break (CURLE_OK ==
                 curl_easy_setopt (eh,
                                   CURLOPT_VERBOSE,
diff --git a/src/kyclogic/plugin_kyclogic_oauth2.c b/src/kyclogic/plugin_kyclogic_oauth2.c
@@ -718,10 +718,16 @@ handle_curl_setup_finished (void *cls,
         oauth2_initiate_cancel (ih);
         return;
       }
-      GNUNET_asprintf (&url,
-                       "%s/%s",
-                       pd->authorize_url,
-                       nonce);
+      {
+        char *nonce_encoded;
+
+        nonce_encoded = TALER_urlencode (nonce);
+        GNUNET_asprintf (&url,
+                         "%s/%s",
+                         pd->authorize_url,
+                         nonce_encoded);
+        GNUNET_free (nonce_encoded);
+      }
       initiate_with_url (ih,
                          url);
       GNUNET_free (url);
diff --git a/src/kyclogic/plugin_kyclogic_persona.c b/src/kyclogic/plugin_kyclogic_persona.c
@@ -767,11 +767,17 @@ handle_initiate_finished (void *cls,
               "Starting inquiry %s for Persona account %s\n",
               inquiry_id,
               persona_account_id);
-  GNUNET_asprintf (&url,
-                   "https://%s.withpersona.com/verify"
-                   "?inquiry-id=%s",
-                   pd->subdomain,
-                   inquiry_id);
+  {
+    char *inquiry_id_encoded;
+
+    inquiry_id_encoded = TALER_urlencode (inquiry_id);
+    GNUNET_asprintf (&url,
+                     "https://%s.withpersona.com/verify"
+                     "?inquiry-id=%s",
+                     pd->subdomain,
+                     inquiry_id_encoded);
+    GNUNET_free (inquiry_id_encoded);
+  }
   ih->cb (ih->cb_cls,
           TALER_EC_NONE,
           url,
@@ -1557,9 +1563,17 @@ persona_proof (void *cls,
     ph->provider_user_id = GNUNET_strdup (provider_user_id);
   if (NULL != inquiry_id)
     ph->inquiry_id = GNUNET_strdup (inquiry_id);
-  GNUNET_asprintf (&ph->url,
-                   "https://withpersona.com/api/v1/inquiries/%s",
-                   inquiry_id);
+  {
+    char *inquiry_id_encoded;
+
+    inquiry_id_encoded = TALER_urlencode (NULL != inquiry_id
+                                          ? inquiry_id
+                                          : "");
+    GNUNET_asprintf (&ph->url,
+                     "https://withpersona.com/api/v1/inquiries/%s",
+                     inquiry_id_encoded);
+    GNUNET_free (inquiry_id_encoded);
+  }
   GNUNET_break (CURLE_OK ==
                 curl_easy_setopt (eh,
                                   CURLOPT_VERBOSE,
@@ -2300,9 +2314,15 @@ persona_webhook (void *cls,
     return wh;
   }
 
-  GNUNET_asprintf (&wh->url,
-                   "https://withpersona.com/api/v1/inquiries/%s",
-                   persona_inquiry_id);
+  {
+    char *inquiry_id_encoded;
+
+    inquiry_id_encoded = TALER_urlencode (persona_inquiry_id);
+    GNUNET_asprintf (&wh->url,
+                     "https://withpersona.com/api/v1/inquiries/%s",
+                     inquiry_id_encoded);
+    GNUNET_free (inquiry_id_encoded);
+  }
   GNUNET_break (CURLE_OK ==
                 curl_easy_setopt (eh,
                                   CURLOPT_VERBOSE,