romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-11 10:51:20 +03:00
Code Issues Projects Releases Packages Wiki Activity

cookies: reject oversized cookies

Browse source 
... instead of truncating them.

There's no fixed limit for acceptable cookie names in RFC 6265, but the
entire cookie is said to be less than 4096 bytes (section 6.1). This is
also what browsers seem to implement.

We now allow max 5000 bytes cookie header. Max 4095 bytes length per
cookie name and value. Name + value together may not exceed 4096 bytes.

Added test 1151 to verify

Bug: https://curl.haxx.se/mail/lib-2017-09/0062.html
Reported-by: Kevin Smith

Closes #1894
This commit is contained in:
Daniel Stenberg 2017-09-18 00:55:07 +02:00
parent 1a072796d3
commit 2bc230de63
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
5 changed files with 96 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

27
lib/cookie.c
View file

@ -375,7 +375,6 @@ Curl_cookie_add(struct Curl_easy *data,
unless set */
{
struct Cookie *clist;
char name[MAX_NAME];
struct Cookie *co;
struct Cookie *lastc = NULL;
time_t now = time(NULL);
@ -397,12 +396,14 @@ Curl_cookie_add(struct Curl_easy *data,
if(httpheader) {
/* This line was read off a HTTP-header */
char name[MAX_NAME];
char what[MAX_NAME];
const char *ptr;
const char *semiptr;
char *what;
what = malloc(MAX_COOKIE_LINE);
if(!what) {
size_t linelength = strlen(lineptr);
if(linelength > MAX_COOKIE_LINE) {
/* discard overly long lines at once */
free(co);
return NULL;
}
@ -417,7 +418,7 @@ Curl_cookie_add(struct Curl_easy *data,
/* we have a <what>=<this> pair or a stand-alone word here */
name[0] = what[0] = 0; /* init the buffers */
if(1 <= sscanf(ptr, "%" MAX_NAME_TXT "[^;\r\n=] =%"
MAX_COOKIE_LINE_TXT "[^;\r\n]",
MAX_NAME_TXT "[^;\r\n]",
name, what)) {
/* Use strstore() below to properly deal with received cookie
headers that have the same string property set more than once,
@ -429,6 +430,20 @@ Curl_cookie_add(struct Curl_easy *data,
size_t nlen = strlen(name);
const char *endofn = &ptr[ nlen ];
infof(data, "cookie size: name/val %d + %d bytes\n",
nlen, len);
if(nlen >= (MAX_NAME-1) || len >= (MAX_NAME-1) ||
((nlen + len) > MAX_NAME)) {
/* too long individual name or contents, or too long combination of
name + contents. Chrome and Firefox support 4095 or 4096 bytes
combo. */
free(co);
infof(data, "oversized cookie dropped, name/val %d + %d bytes\n",
nlen, len);
return NULL;
}
/* name ends with a '=' ? */
sep = (*endofn == '=')?TRUE:FALSE;
@ -659,8 +674,6 @@ Curl_cookie_add(struct Curl_easy *data,
}
}
free(what);
if(badcookie || !co->name) {
/* we didn't get a cookie name or a bad one,
this is an illegal line, bail out */

11
lib/cookie.h
View file

@ -7,7 +7,7 @@
* | (__| |_| | _ <| |___
* \___|\___/|_| \_\_____|
*
* Copyright (C) 1998 - 2016, Daniel Stenberg, <daniel@haxx.se>, et al.
* Copyright (C) 1998 - 2017, Daniel Stenberg, <daniel@haxx.se>, et al.
*
* This software is licensed as described in the file COPYING, which
* you should have received as part of this distribution. The terms
@ -62,13 +62,16 @@ struct CookieInfo {
that comprise the cookie non-terminal in the syntax description of the
Set-Cookie header)"
We allow max 5000 bytes cookie header. Max 4095 bytes length per cookie
name and value. Name + value may not exceed 4096 bytes.
*/
#define MAX_COOKIE_LINE 5000
#define MAX_COOKIE_LINE_TXT "4999"
/* This is the maximum length of a cookie name we deal with: */
#define MAX_NAME 1024
#define MAX_NAME_TXT "1023"
/* This is the maximum length of a cookie name or content we deal with: */
#define MAX_NAME 4096
#define MAX_NAME_TXT "4095"
struct Curl_easy;
/*