Release v2025.11.04

Author: samueloph

CHANGELOG.md

@@ -8,8 +8,9 @@ SPDX-License-Identifier: curl
 
 # Changelog
 
-## [UNRELEASED]
- * Don't percent-decode `/` and `\` in output file name.
+## [v2025.11.04]
+ * Fix CVE-2025-11563: Don't percent-decode `/` and `\` in output file name to
+   avoid path traversal.
  * Fix typos reported by pyspelling.
  * Multiple improvements to GitHub Actions.
 

wcurl

@@ -29,7 +29,7 @@
 # Stop on errors and on usage of unset variables.
 set -eu
 
-VERSION="2025.09.27+dev"
+VERSION="2025.11.04"
 
 PROGRAM_NAME="$(basename "$0")"
 readonly PROGRAM_NAME

wcurl.1

@@ -0,0 +1,118 @@
+.\" generated by cd2nroff 0.1 from wcurl.md
+.TH wcurl 1 "2025-11-04" wcurl
+.SH NAME
+\fBwcurl\fP \- a simple wrapper around curl to easily download files.
+.SH SYNOPSIS
+\fBwcurl <URL>...\fP
+
+\fBwcurl [\--curl\-options <CURL_OPTIONS>]... [\--dry\-run] [\--no\-decode\-filename] [\-o|\-O|\--output <PATH>] [\--] <URL>...\fP
+
+\fBwcurl [\--curl\-options=<CURL_OPTIONS>]... [\--dry\-run] [\--no\-decode\-filename] [\--output=<PATH>] [\--] <URL>...\fP
+
+\fBwcurl \-V|\--version\fP
+
+\fBwcurl \-h|\--help\fP
+.SH DESCRIPTION
+\fBwcurl\fP is a simple curl wrapper which lets you use curl to download files
+without having to remember any parameters.
+
+Simply call \fBwcurl\fP with a list of URLs you want to download and \fBwcurl\fP
+picks sane defaults.
+
+If you need anything more complex, you can provide any of curl\(aqs supported
+parameters via the \fB\--curl\-options\fP option. Just beware that you likely
+should be using curl directly if your use case is not covered.
+
+By default, \fBwcurl\fP does:
+.IP "* Percent-encode whitespace in URLs;"
+.IP "* Download multiple URLs in parallel"
+.nf
+if the installed curl's version is \>= 7.66.0 (--parallel);
+.fi
+.IP "* Use a total number of 5 parallel connections to the same protocol + hostname + port number target"
+.nf
+if the installed curl's version is \>= 8.16.0 (--parallel-max-host);
+.fi
+.IP "* Follow redirects;"
+.IP "* Automatically choose a filename as output;"
+.IP "* Avoid overwriting files"
+.nf
+ if the installed curl's version is \>= 7.83.0 (--no-clobber);
+.fi
+.IP "* Perform retries;"
+.IP "* Set the downloaded file timestamp"
+.nf
+to the value provided by the server, if available;
+.fi
+.IP "* Default to https"
+.nf
+if the URL does not contain any scheme;
+.fi
+.IP "* Disable curl's URL globbing parser"
+.nf
+so {} and [] characters in URLs are not treated specially;
+.fi
+.IP "* Percent-decode the resulting filename;"
+.IP "* Use 'index.html' as the default filename"
+.nf
+if there is none in the URL.
+.fi
+.SH OPTIONS
+.IP "--curl-options, --curl-options=\<CURL_OPTIONS\>..."
+Specify extra options to be passed when invoking curl. May be specified more
+than once.
+.IP "-o, -O, --output, --output=\<PATH\>"
+Use the provided output path instead of getting it from the URL. If multiple
+URLs are provided, resulting files share the same name with a number appended to
+the end (curl >= 7.83.0). If this option is provided multiple times, only the
+last value is considered.
+.IP --no-decode-filename
+Don\(aqt percent\-decode the output filename, even if the percent\-encoding in the
+URL was done by \fBwcurl\fP, e.g.: The URL contained whitespace.
+.IP --dry-run
+Do not actually execute curl, just print what would be invoked.
+.IP "-V, \--version"
+Print version information.
+.IP "-h, \--help"
+Print help message.
+.SH CURL_OPTIONS
+Any option supported by curl can be set here. This is not used by \fBwcurl\fP; it
+is instead forwarded to the curl invocation.
+.SH URL
+URL to be downloaded. Anything that is not a parameter is considered
+an URL. Whitespace is percent\-encoded and the URL is passed to curl, which
+then performs the parsing. May be specified more than once.
+.SH EXAMPLES
+Download a single file:
+
+\fBwcurl example.com/filename.txt\fP
+
+Download two files in parallel:
+
+\fBwcurl example.com/filename1.txt example.com/filename2.txt\fP
+
+Download a file passing the \fB\--progress\-bar\fP and \fB\--http2\fP flags to curl:
+
+\fBwcurl \--curl\-options="\--progress\-bar \--http2" example.com/filename.txt\fP
+
+* Resume from an interrupted download. The options necessary to resume the download (\fI\--clobber \--continue\-at \-\fP) must be the \fBlast\fP options specified in \fI\--curl\-options\fP. Note that the only way to resume interrupted downloads is to allow wcurl to overwrite the destination file:
+
+\fBwcurl \--curl\-options="\--clobber \--continue\-at \-" example.com/filename.txt\fP
+
+Download multiple files without a limit of concurrent connections per host (the default limit is 5):
+
+\fBwcurl \--curl\-options="\--parallel\-max\-host 0" example.com/filename1.txt example.com/filename2.txt\fP
+.SH AUTHORS
+.nf
+Samuel Henrique \<[email protected]\>
+Sergio Durigan Junior \<[email protected]\>
+and many contributors, see the AUTHORS file.
+.fi
+.SH REPORTING BUGS
+If you experience any problems with \fBwcurl\fP that you do not experience with
+curl, submit an issue on GitHub: https://github.com/curl/wcurl
+.SH COPYRIGHT
+\fBwcurl\fP is licensed under the curl license
+.SH SEE ALSO
+.BR curl (1),
+.BR trurl (1)