romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-24 22:13:33 +03:00
Code Issues Projects Releases Packages Wiki Activity

docs: describe and highlight super cookies

Browse source 
Reported-by: Yadhu Krishna M

Closes #12687
This commit is contained in:
Daniel Stenberg 2024-01-12 16:50:44 +01:00
parent b3f02e1d92
commit 5da57193b7
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
4 changed files with 37 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

7
docs/libcurl/libcurl-security.3
View file

@ -420,6 +420,13 @@ credentials may be left in freed data.
.SH "Saving files"
libcurl cannot protect against attacks where an attacker has write access to
the same directory where libcurl is directed to save files.
.SH "Cookies"
If libcurl is built with PSL (**Public Suffix List**) support, it detects and
discards cookies that are specified for such suffix domains that should not be
allowed to have cookies.
if libcurl is *not* built with PSL support, it has no ability to stop super
cookies.
.SH "Report Security Problems"
Should you detect or just suspect a security problem in libcurl or curl,
contact the project curl security team immediately. See

6
docs/libcurl/opts/CURLOPT_COOKIE.3
View file

@ -62,6 +62,12 @@ automatically.
The application does not have to keep the string around after setting this
option.
If libcurl is built with PSL (*Public Suffix List*) support, it detects and
discards cookies that are specified for such suffix domains that should not be
allowed to have cookies. If libcurl is *not* built with PSL support, it has no
ability to stop super cookies. PSL support is identified by the
\fBCURL_VERSION_PSL\fP feature bit returned by \fIcurl_version_info(3)\fP.
.SH DEFAULT
NULL, no cookies
.SH PROTOCOLS