curl --continue-at confusion
Medium
C
curl
Submitted None
Actions:
Reported by
nyymi
Vulnerability Details
Technical details and impact analysis
## Summary:
When curl command is used with `--continue-at`, the `--no-clobber` is unexpectedly ignored and curl will append the output to the target file, even if it already exists. If `--continue-at` is used with`--remove-on-error` it can lead to unexpected removal of the file on early errors. Note that this also happens when combined with `--remote-name` and `--remote-header-name`.
## Steps To Reproduce:
### Tampering a file even if `--no-clobber`:
1. `echo not to be touched > robots.txt`
2. `curl --no-clobber -C 1 -O https://curl.se/robots.txt`
NOTE: Without `-C 1` the output is written to `robots.txt.<n>`.
### Deleting a file when combining `--remove-on-error` with `--continue-at`:
1. `echo something > important`
2. `curl --remove-on-error -C 1 -o important https://nonexisting.curl.se/`
NOTE: Without `-C 1` the file is not removed.
## Remediation
The easiest way to stop these issues from happening is to forbid use of `--continue-at` in combination with `--no-clobber` or `--remove-on-error`.
## Impact
Unexpected modification or deletion of an existing file.
Report Details
Additional information and metadata
State
Closed
Substate
Not-Applicable
Submitted
Weakness
Business Logic Errors