URL rebuild triggered when embedded password contains # character

[jeffding45]

I did this

Curl is rebuilding a URL incorrectly when an embedded password uses a # character.

curl --verbose ftp://username:pass#word@ftp.domain.com/

• Rebuilt URL to: ftp://username:pass/#word@ftp.domain.com/
• Port number ended with 'p'
• Closing connection -1
  curl: (3) Port number ended with 'p'

I expected the following

The URL should not be rebuilt when using protocols other than HTTP for example. curl 7.44.0 does not have this issue.

curl/libcurl version

curl 7.55.1 (i386-pc-win32) libcurl/7.55.1 OpenSSL/1.1.0f zlib/1.2.11 libssh2/1.8.0
Release-Date: 2017-08-14
Protocols: dict file ftp ftps gopher http https imap imaps ldap pop3 pop3s rtsp scp sftp smtp smtps telnet tftp
Features: AsynchDNS Largefile SSPI Kerberos SPNEGO NTLM SSL libz HTTPS-proxy

operating system

Windows Server 2012 R2, Windows 10

[bagder]

The '#` character is a bit magic in URLs. According to RFC 3986 section 2.2, it is reserved for delimiting.

This means that you need to URL encode it (as %23) if you want to use it somewhere within the URL and not have it indicate the fragment part of the URL:

curl --verbose ftp://username:pass%23word@ftp.domain.com/

The fact that it once worked for you was unfortunately only a lucky chance and since we've modified the parser and the URL handling so that it no longer works that way. The letter # however had the same status in the URL spec the entire time.

[bagder]

I'm inclined to say that this works as intended.