romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-28 00:23:06 +03:00
Code Issues Projects Releases Packages Wiki Activity

cookie: lowercase the domain names before PSL checks

Browse source 
Reported-by: Harry Sintonen

Closes #12387
This commit is contained in:
Daniel Stenberg 2023-11-23 08:15:47 +01:00
parent 006977859d
commit 2b0994c29a
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
1 changed files with 16 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

24
lib/cookie.c
View file

@ -1027,15 +1027,23 @@ Curl_cookie_add(struct Curl_easy *data,
* dereference it.
*/
if(data && (domain && co->domain && !Curl_host_is_ipnum(co->domain))) {
const psl_ctx_t *psl = Curl_psl_use(data);
int acceptable;
if(psl) {
acceptable = psl_is_cookie_domain_acceptable(psl, domain, co->domain);
Curl_psl_release(data);
bool acceptable = FALSE;
char lcase[256];
char lcookie[256];
size_t dlen = strlen(domain);
size_t clen = strlen(co->domain);
if((dlen < sizeof(lcase)) && (clen < sizeof(lcookie))) {
const psl_ctx_t *psl = Curl_psl_use(data);
if(psl) {
/* the PSL check requires lowercase domain name and pattern */
Curl_strntolower(lcase, domain, dlen + 1);
Curl_strntolower(lcookie, co->domain, clen + 1);
acceptable = psl_is_cookie_domain_acceptable(psl, lcase, lcookie);
Curl_psl_release(data);
}
else
acceptable = !bad_domain(domain, strlen(domain));
}
else
acceptable = !bad_domain(domain, strlen(domain));
if(!acceptable) {
infof(data, "cookie '%s' dropped, domain '%s' must not "