From 2b4afd8dd2132a0edd16acbe7c8d4d5c4fd06e61 Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Tue, 19 Apr 2022 12:49:28 +0200
Subject: [PATCH 2/3] transfer: redirects to other protocols or ports clear
 auth

... unless explicitly permitted.

Bug: https://curl.se/docs/CVE-2022-27774.html
Reported-by: Harry Sintonen
diff --git a/lib/transfer.c b/lib/transfer.c
index b8c3bcb..967ac03 100644
--- a/lib/transfer.c
+++ b/lib/transfer.c
@@ -1645,10 +1645,53 @@ CURLcode Curl_follow(struct Curl_easy *data,
       return CURLE_OUT_OF_MEMORY;
   }
   else {
-
     uc = curl_url_get(data->state.uh, CURLUPART_URL, &newurl, 0);
     if(uc)
       return Curl_uc_to_curlcode(uc);
+
+    /* Clear auth if this redirects to a different port number or protocol,
+       unless permitted */
+    if(!data->set.allow_auth_to_other_hosts && (type != FOLLOW_FAKE)) {
+      char *portnum;
+      int port;
+      bool clear = FALSE;
+
+      uc = curl_url_get(data->state.uh, CURLUPART_PORT, &portnum,
+                        CURLU_DEFAULT_PORT);
+      if(uc) {
+        free(newurl);
+        return Curl_uc_to_curlcode(uc);
+      }
+      port = atoi(portnum);
+      free(portnum);
+
+      if(port != data->info.conn_remote_port) {
+        infof(data, "Clear auth, redirects to port from %u to %u",
+              data->info.conn_remote_port, port);
+        clear = TRUE;
+      }
+      else {
+        char *scheme;
+        const struct Curl_handler *p;
+        uc = curl_url_get(data->state.uh, CURLUPART_SCHEME, &scheme, 0);
+        if(uc) {
+          free(newurl);
+          return Curl_uc_to_curlcode(uc);
+        }
+
+        p = Curl_builtin_scheme(scheme);
+        if(p && (p->protocol != data->info.conn_protocol)) {
+          infof(data, "Clear auth, redirects scheme from %s to %s",
+                data->info.conn_scheme, scheme);
+          clear = TRUE;
+        }
+        free(scheme);
+      }
+      if(clear) {
+        Curl_safefree(data->set.str[STRING_USERNAME]);
+        Curl_safefree(data->set.str[STRING_PASSWORD]);
+      }
+    }
   }
 
   if(type == FOLLOW_FAKE) {