romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 14:23:39 +03:00
Code Issues Projects Releases Packages Wiki Activity

digest: pass over leading spaces in qop values

Browse source 
When parsing the "qop=" parameter of the digest authentication, and the
value is provided within quotes, the list of values can have leading
white space which the parser previously did not handle correctly.

Add test case 388 to verify.

Reported-by: vlubart on github
Fixes #9264
Closes #9270
This commit is contained in:
Daniel Stenberg 2022-08-08 00:30:58 +02:00
parent 3fe24ea322
commit 0ad7c8d7d5
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
3 changed files with 160 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
lib/vauth/digest.c
View file

@ -560,6 +560,9 @@ CURLcode Curl_auth_decode_digest_http_message(const char *chlg,
token = strtok_r(tmp, ",", &tok_buf);
while(token) {
/* Pass additional spaces here */
while(*token && ISSPACE(*token))
token++;
if(strcasecompare(token, DIGEST_QOP_VALUE_STRING_AUTH)) {
foundAuth = TRUE;
}