romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-04-14 22:31:41 +03:00
Code Issues Projects Releases Packages Wiki Activity

cookie: apply limits

Browse source 
- Send no more than 150 cookies per request
- Cap the max length used for a cookie: header to 8K
- Cap the max number of received Set-Cookie: headers to 50

Bug: https://curl.se/docs/CVE-2022-32205.html
CVE-2022-32205
Reported-by: Harry Sintonen
Closes #9048
This commit is contained in:
Daniel Stenberg 2022-06-26 11:00:48 +02:00
parent 7230b19a2e
commit 48d7064a49
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
4 changed files with 43 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

21
lib/cookie.h
View file

@ -83,10 +83,26 @@ struct CookieInfo {
*/
#define MAX_COOKIE_LINE 5000
/* This is the maximum length of a cookie name or content we deal with: */
/* Maximum length of an incoming cookie name or content we deal with. Longer
cookies are ignored. */
#define MAX_NAME 4096
#define MAX_NAME_TXT "4095"
/* Maximum size for an outgoing cookie line libcurl will use in an http
request. This is the default maximum length used in some versions of Apache
httpd. */
#define MAX_COOKIE_HEADER_LEN 8190
/* Maximum number of cookies libcurl will send in a single request, even if
there might be more cookies that match. One reason to cap the number is to
keep the maximum HTTP request within the maximum allowed size. */
#define MAX_COOKIE_SEND_AMOUNT 150
/* Maximum number of Set-Cookie: lines accepted in a single response. If more
such header lines are received, they are ignored. This value must be less
than 256 since an unsigned char is used to count. */
#define MAX_SET_COOKIE_AMOUNT 50
struct Curl_easy;
/*
* Add a cookie to the internal list of cookies. The domain and path arguments
@ -99,7 +115,8 @@ struct Cookie *Curl_cookie_add(struct Curl_easy *data,
const char *domain, const char *path,
bool secure);
struct Cookie *Curl_cookie_getlist(struct CookieInfo *c, const char *host,
struct Cookie *Curl_cookie_getlist(struct Curl_easy *data,
struct CookieInfo *c, const char *host,
const char *path, bool secure);
void Curl_cookie_freelist(struct Cookie *cookies);
void Curl_cookie_clearall(struct CookieInfo *cookies);