curl: add options for safe/no CA bundle search (Windows)

Add `CURL_CA_SEARCH_SAFE` build-time option to enable CA bundle search
in the `curl` tool directory. The lookup method was already used to find
`.curlrc` and `_curlrc` (on Windows). On Windows it overrides the unsafe
default `SearchPath()` method.

Enable with:
- cmake: `-DCURL_CA_SEARCH_SAFE=ON`
- autotools: `--enable-ca-search-safe`
- raw: `CPPFLAGS=-DCURL_CA_SEARCH_SAFE`

On Windows, before this patch the whole `PATH` was searched for
a CA bundle. `PATH` may contain unwanted or world-writable locations,
including the current directory. Searching them all is convenient to
pick up any CA bundle, but not secure.

The Muldersoft curl distro implements such CA search via a custom
patch for Windows:
cd652d4792/patch/curl_tool_doswin.diff (L50)

MSYS2/mingw-w64 distro has also been rolling a patch solving this:
https://github.com/msys2/MINGW-packages/blob/master/mingw-w64-curl/0001-Make-cURL-relocatable.patch
https://github.com/msys2/MINGW-packages/blob/master/mingw-w64-curl/pathtools.c

Also add option to fully disable Windows CA search:
- cmake: `-DCURL_DISABLE_CA_SEARCH=ON`
- autotools: `--disable-ca-search`
- raw: `CPPFLAGS=-DCURL_DISABLE_CA_SEARCH`.

Both options are considered EXPERIMENTAL, with possible incompatible
changes or even (partial) removal in the future, depending on feedback.

An alternative, secure option is to embed the CA bundle into the binary.

Safe search can be extended to other platforms if necessary or useful,
by using `_NSGetExecutablePath()` (macOS),
`/proc/self/exe` (Linux/Cygwin), or `argv[0]`.

Closes #14582

src/tool_doswin.c

@@ -600,6 +600,8 @@ char **__crt0_glob_function(char *arg)
 
 #ifdef _WIN32
 
+#if !defined(CURL_WINDOWS_UWP) && \
+  !defined(CURL_DISABLE_CA_SEARCH) && !defined(CURL_CA_SEARCH_SAFE)
 /* Search and set the CA cert file for Windows.
  *
  * Do not call this function if Schannel is the selected SSL backend. We allow
@@ -623,11 +625,6 @@ CURLcode FindWin32CACert(struct OperationConfig *config,
                          const TCHAR *bundle_file)
 {
   CURLcode result = CURLE_OK;
-
-#ifdef CURL_WINDOWS_UWP
-  (void)config;
-  (void)bundle_file;
-#else
   DWORD res_len;
   TCHAR buf[PATH_MAX];
   TCHAR *ptr = NULL;
@@ -644,11 +641,10 @@ CURLcode FindWin32CACert(struct OperationConfig *config,
     if(!config->cacert)
       result = CURLE_OUT_OF_MEMORY;
   }
-#endif
 
   return result;
 }
-
+#endif
 
 /* Get a list of all loaded modules with full paths.
  * Returns slist on success or NULL on error.

src/tool_doswin.h

@@ -59,8 +59,11 @@ char **__crt0_glob_function(char *arg);
 
 #ifdef _WIN32
 
+#if !defined(CURL_WINDOWS_UWP) && \
+  !defined(CURL_DISABLE_CA_SEARCH) && !defined(CURL_CA_SEARCH_SAFE)
 CURLcode FindWin32CACert(struct OperationConfig *config,
                          const TCHAR *bundle_file);
+#endif
 struct curl_slist *GetLoadedModulePaths(void);
 CURLcode win32_init(void);
 

src/tool_operate.c

@@ -3083,8 +3083,18 @@ static CURLcode transfer_per_config(struct GlobalConfig *global,
       }
 
 #ifdef _WIN32
-      if(!env)
+      if(!env) {
+#if defined(CURL_CA_SEARCH_SAFE)
+        char *cacert = NULL;
+        FILE *cafile = Curl_execpath("curl-ca-bundle.crt", &cacert);
+        if(cafile) {
+          fclose(cafile);
+          config->cacert = strdup(cacert);
+        }
+#elif !defined(CURL_WINDOWS_UWP) && !defined(CURL_DISABLE_CA_SEARCH)
         result = FindWin32CACert(config, TEXT("curl-ca-bundle.crt"));
+#endif
+      }
 #endif
     }
     curl_easy_cleanup(curltls);

src/tool_parsecfg.c

@@ -31,6 +31,7 @@
 #include "tool_findfile.h"
 #include "tool_msgs.h"
 #include "tool_parsecfg.h"
+#include "tool_util.h"
 #include "dynbuf.h"
 
 #include "memdebug.h" /* keep this as LAST include */
@@ -44,37 +45,6 @@ static const char *unslashquote(const char *line, char *param);
 #define MAX_CONFIG_LINE_LENGTH (10*1024*1024)
 static bool my_get_line(FILE *fp, struct curlx_dynbuf *, bool *error);
 
-#ifdef _WIN32
-static FILE *execpath(const char *filename, char **pathp)
-{
-  static char filebuffer[512];
-  /* Get the filename of our executable. GetModuleFileName is already declared
-   * via inclusions done in setup header file. We assume that we are using
-   * the ASCII version here.
-   */
-  unsigned long len = GetModuleFileNameA(0, filebuffer, sizeof(filebuffer));
-  if(len > 0 && len < sizeof(filebuffer)) {
-    /* We got a valid filename - get the directory part */
-    char *lastdirchar = strrchr(filebuffer, '\\');
-    if(lastdirchar) {
-      size_t remaining;
-      *lastdirchar = 0;
-      /* If we have enough space, build the RC filename */
-      remaining = sizeof(filebuffer) - strlen(filebuffer);
-      if(strlen(filename) < remaining - 1) {
-        FILE *f;
-        msnprintf(lastdirchar, remaining, "%s%s", DIR_CHAR, filename);
-        *pathp = filebuffer;
-        f = fopen(filebuffer, FOPEN_READTEXT);
-        return f;
-      }
-    }
-  }
-
-  return NULL;
-}
-#endif
-
 
 /* return 0 on everything-is-fine, and non-zero otherwise */
 int parseconfig(const char *filename, struct GlobalConfig *global)
@@ -100,9 +70,9 @@ int parseconfig(const char *filename, struct GlobalConfig *global)
     else {
       char *fullp;
       /* check for .curlrc then _curlrc in the dir of the executable */
-      file = execpath(".curlrc", &fullp);
+      file = Curl_execpath(".curlrc", &fullp);
       if(!file)
-        file = execpath("_curlrc", &fullp);
+        file = Curl_execpath("_curlrc", &fullp);
       if(file)
         /* this is the filename we read from */
         filename = fullp;

src/tool_util.c

@@ -29,6 +29,7 @@
 
 #include "tool_util.h"
 
+#include "curlx.h"
 #include "memdebug.h" /* keep this as LAST include */
 
 #if defined(_WIN32)
@@ -188,3 +189,33 @@ int tool_ftruncate64(int fd, curl_off_t where)
 }
 
 #endif /* USE_TOOL_FTRUNCATE */
+
+#ifdef _WIN32
+FILE *Curl_execpath(const char *filename, char **pathp)
+{
+  static char filebuffer[512];
+  unsigned long len;
+  /* Get the filename of our executable. GetModuleFileName is already declared
+   * via inclusions done in setup header file. We assume that we are using
+   * the ASCII version here.
+   */
+  len = GetModuleFileNameA(0, filebuffer, sizeof(filebuffer));
+  if(len > 0 && len < sizeof(filebuffer)) {
+    /* We got a valid filename - get the directory part */
+    char *lastdirchar = strrchr(filebuffer, DIR_CHAR[0]);
+    if(lastdirchar) {
+      size_t remaining;
+      *lastdirchar = 0;
+      /* If we have enough space, build the RC filename */
+      remaining = sizeof(filebuffer) - strlen(filebuffer);
+      if(strlen(filename) < remaining - 1) {
+        msnprintf(lastdirchar, remaining, "%s%s", DIR_CHAR, filename);
+        *pathp = filebuffer;
+        return fopen(filebuffer, FOPEN_READTEXT);
+      }
+    }
+  }
+
+  return NULL;
+}
+#endif

src/tool_util.h

@@ -39,4 +39,8 @@ long tvdiff(struct timeval t1, struct timeval t2);
 int struplocompare(const char *p1, const char *p2);
 int struplocompare4sort(const void *p1, const void *p2);
 
+#ifdef _WIN32
+FILE *Curl_execpath(const char *filename, char **pathp);
+#endif
+
 #endif /* HEADER_CURL_TOOL_UTIL_H */