http: ignore invalid Retry-After times

- Treat negative Retry-After date-based times as 0.

- Treat Retry-After times greater than 6 hours as 6 hours.

Prior to this change Retry-After did not have a limited range and the
server could have set a time greater than 6 hours or a date in the past
that would result in a negative time, either of which may be unexpected
by the user.

The 6 hour limit is purposely not documented so that it can be changed
in the future if necessary.

Closes https://github.com/curl/curl/pull/15833
This commit is contained in:
Jay Satiro 2024-12-26 15:38:39 -05:00
parent 8d1f26b866
commit 6c70ec16c7
4 changed files with 20 additions and 12 deletions

View file

@ -13,9 +13,9 @@ If-Modified-Since
<reply>
<data nocheck="yes">
HTTP/1.1 429 Too Many Requests
Date: Thu, 11 Jul 2019 02:26:59 GMT
Date: Wed, 31 Dec 2036 02:26:59 GMT
Server: test-server/swsclose
Retry-After: Thu, 11 Jul 2024 02:26:59 GMT
Retry-After: Wed, 31 Dec 2036 02:26:59 GMT
</data>
</reply>
@ -42,8 +42,9 @@ Host: %HOSTIP:%HTTPPORT
Accept: */*
</protocol>
# Retry-After time is limited to 6 hours (21600 seconds)
<stdout>
Retry-After 172066
Retry-After 21600
</stdout>
</verify>
</testcase>