Stephan Bergmann made libcurl return CURLE_URL_MALFORMAT if an FTP URL contains %0a or %0d in the user, password or CWD parts. (A future fix would include doing it for %00 as well - see KNOWN_BUGS for details.) Test case 225 and 226 were added to verify this
diff --git a/docs/TODO b/docs/TODO index dbda550..6a8b479 100644 --- a/docs/TODO +++ b/docs/TODO
@@ -65,6 +65,9 @@ FTP + * Make the detection of (bad) %0d and %0a codes in FTP url parts earlier in + the process to avoid doing a resolve and connect in vain. + * Code overhaul to make it more state-machine like and to _never_ block on waiting for server responses when used with the multi interface.
