romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-05-30 10:17:28 +03:00
Code Issues Projects Releases Packages Wiki Activity

url: allow non-HTTPS HSTS-matching for debug builds

Browse source 
Closes #9728
This commit is contained in:
Shaun Mirani 2022-10-12 16:27:43 -03:00 • committed by Daniel Stenberg
parent 502b6a5a32
commit 6efb6b1e77
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
1 changed files with 8 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

9
lib/http.c
View file

@ -3715,7 +3715,14 @@ CURLcode Curl_http_header(struct Curl_easy *data, struct connectdata *conn,
#ifndef CURL_DISABLE_HSTS
/* If enabled, the header is incoming and this is over HTTPS */
else if(data->hsts && checkprefix("Strict-Transport-Security:", headp) &&
(conn->handler->flags & PROTOPT_SSL)) {
((conn->handler->flags & PROTOPT_SSL) ||
#ifdef CURLDEBUG
/* allow debug builds to circumvent the HTTPS restriction */
getenv("CURL_HSTS_HTTP")
#else
0
#endif
)) {
CURLcode check =
Curl_hsts_parse(data->hsts, data->state.up.hostname,
headp + strlen("Strict-Transport-Security:"));