romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-05 03:36:14 +03:00
Code Issues Projects Releases Packages Wiki Activity

http: don't pass on set cookies to new origins

Browse source 
Verified by test 2015

Reported-by: azraelxuemo on hackerone

Closes #21794
This commit is contained in:
Daniel Stenberg 2026-05-28 10:14:08 +02:00
parent a0c559ff03
commit 5e66176733
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
3 changed files with 94 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

3
lib/http.c
View file

@ -2530,7 +2530,8 @@ static CURLcode http_cookies(struct Curl_easy *data,
char *addcookies = NULL;
bool linecap = FALSE;
if(data->set.str[STRING_COOKIE] &&
!Curl_checkheaders(data, STRCONST("Cookie")))
!Curl_checkheaders(data, STRCONST("Cookie")) &&
Curl_auth_allowed_to_host(data))
addcookies = data->set.str[STRING_COOKIE];
if(data->cookies || addcookies) {

2
tests/data/Makefile.am
View file

@ -245,7 +245,7 @@ test1970 test1971 test1972 test1973 test1974 test1975 test1976 test1977 \
test1978 test1979 test1980 test1981 test1982 test1983 test1984 \
\
test2000 test2001 test2002 test2003 test2004 test2005 test2006 test2007 \
test2008 test2009 test2010 test2011 test2012 test2013 test2014 \
test2008 test2009 test2010 test2011 test2012 test2013 test2014 test2015 \
\
test2023 \
test2024 test2025 test2026 test2027 test2028 test2029 test2030 test2031 \

91
tests/data/test2015 Normal file
View file

@ -0,0 +1,91 @@
<?xml version="1.0" encoding="US-ASCII"?>
<testcase>
<info>
<keywords>
HTTP
HTTP proxy
followlocation
cookies
</keywords>
</info>
# Server-side
<reply>
<data>
HTTP/1.1 302 OK
Date: Tue, 09 Nov 2010 14:49:00 GMT
Server: test-server/fake swsclose
Content-Type: text/html
Funny-head: yesyes
Location: http://goto.second.host.now/%TESTNUMBER0002
Content-Length: 8
Connection: close
contents
</data>
<data2>
HTTP/1.1 200 OK
Date: Tue, 09 Nov 2010 14:49:00 GMT
Server: test-server/fake swsclose
Content-Type: text/html
Funny-head: yesyes
Content-Length: 9
contents
</data2>
<datacheck>
HTTP/1.1 302 OK
Date: Tue, 09 Nov 2010 14:49:00 GMT
Server: test-server/fake swsclose
Content-Type: text/html
Funny-head: yesyes
Location: http://goto.second.host.now/%TESTNUMBER0002
Content-Length: 8
Connection: close
HTTP/1.1 200 OK
Date: Tue, 09 Nov 2010 14:49:00 GMT
Server: test-server/fake swsclose
Content-Type: text/html
Funny-head: yesyes
Content-Length: 9
contents
</datacheck>
</reply>
# Client-side
<client>
<server>
http
</server>
<name>
HTTP with cookie with with -b and redirect to new host
</name>
<command>
http://first.host.it.is/we/want/that/page/%TESTNUMBER -x %HOSTIP:%HTTPPORT -b "test=yes" --location
</command>
<features>
proxy
</features>
</client>
# Verify data after the test has been "shot"
<verify>
<protocol crlf="headers">
GET http://first.host.it.is/we/want/that/page/%TESTNUMBER HTTP/1.1
Host: first.host.it.is
User-Agent: curl/%VERSION
Accept: */*
Proxy-Connection: Keep-Alive
Cookie: test=yes
GET http://goto.second.host.now/%TESTNUMBER0002 HTTP/1.1
Host: goto.second.host.now
User-Agent: curl/%VERSION
Accept: */*
Proxy-Connection: Keep-Alive
</protocol>
</verify>
</testcase>