Skip to content

check for CRLF injection in client (fixes #194)#195

Merged
pohmelie merged 2 commits into
aio-libs:masterfrom
Cycloctane:fix_crlf_injection
Jul 17, 2025
Merged

check for CRLF injection in client (fixes #194)#195
pohmelie merged 2 commits into
aio-libs:masterfrom
Cycloctane:fix_crlf_injection

Conversation

@Cycloctane

Copy link
Copy Markdown
Member

What do these changes do?

This pr uses patch from stdlib. It makes aioftp client raise errors if commands contain illegal newline characters (CR/LF) to prevent injection.

Are there changes in behavior for the user?

Clients won't be affected unless they have CR/LF in username or password, which is not likely to happen.

Related issue number

Fixes #194

Checklist

  • I think the code is well written
  • Unit tests for the changes exist
  • Documentation reflects the changes

@codecov

codecov Bot commented Jul 17, 2025

Copy link
Copy Markdown

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 97.92%. Comparing base (2a34aaf) to head (bdbabe5).
Report is 1 commits behind head on master.

Additional details and impacted files
@@           Coverage Diff           @@
##           master     #195   +/-   ##
=======================================
  Coverage   97.91%   97.92%           
=======================================
  Files           6        6           
  Lines        2113     2116    +3     
=======================================
+ Hits         2069     2072    +3     
  Misses         44       44           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@pohmelie pohmelie changed the title fix CRLF injection in aioftp client check for CRLF injection in client (fixes #194) Jul 17, 2025
@pohmelie pohmelie merged commit 49c28ec into aio-libs:master Jul 17, 2025
10 checks passed
@pohmelie

Copy link
Copy Markdown
Collaborator

Thank you for the contribution

@Cycloctane Cycloctane deleted the fix_crlf_injection branch August 10, 2025 11:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

CRLF injection in aioftp client

2 participants