url: reject control codes in credentials set via CURLOPT

[alhudz]

1. Credentials taken from the URL are decoded with REJECT_CTRL and .netrc credentials are screened with str_has_ctrl(), so a control byte in the user or password is refused for protocols without PROTOPT_USERPWDCTRL (FTP, IMAP, POP3, SMTP).
2. Credentials set with CURLOPT_USERNAME/CURLOPT_PASSWORD (CREDS_OPTION) skipped that screening, so a CR or LF in the value reached the USER/PASS/LOGIN/AUTH command line verbatim.

Applied the same PROTOPT_USERPWDCTRL-gated str_has_ctrl() check to the CURLOPT path so all three credential sources behave the same.

Repro: CURLOPT_USERNAME = anonymous\r\nSTOR /x, URL ftp://host/
Expected: refused before connecting
Actual (before): USER anonymous\r\nSTOR /x\r\nPASS ... written to the control channel, smuggling an extra FTP command
Fix: rejected with CURLE_BAD_FUNCTION_ARGUMENT, nothing sent

test2114 reproduces it over FTP.

[Copilot]

Pull request overview

This PR closes a credential-injection gap by rejecting ASCII control bytes (notably CR/LF) in usernames/passwords provided via CURLOPT_* options for protocols that do not allow such bytes, aligning behavior with URL-decoded and .netrc credential handling.

Changes:

• Add PROTOPT_USERPWDCTRL-gated str_has_ctrl() screening for CREDS_OPTION credentials in url_set_data_creds().
• Refactor str_has_ctrl() visibility so it can be reused outside the .netrc-guarded code.
• Add regression test test2114 and register it in the tests makefile.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
tests/data/test2114	New FTP regression test for rejecting CRLF in credentials provided via config/option path.
tests/data/Makefile.am	Adds test2114 to the test data distribution/list.
lib/url.c	Applies control-code rejection to option-provided credentials for protocols without PROTOPT_USERPWDCTRL.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[bagder]

Thanks!