From 756725a32bee029330f949e231720f867b5312dc Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Thu, 19 Mar 2026 00:12:33 +0100
Subject: [PATCH] tool_operate: drop the scheme-guessing in the -G handling

Prior to this, -G would override the scheme set with --proto-default and
revert back to guessing the scheme based on the hostname.

Add test 2008 to verify the fix

Spotted by Codex Security

Closes #20992
---
 src/tool_operate.c     |  3 ++-
 tests/data/Makefile.am |  1 +
 tests/data/test2008    | 49 ++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 52 insertions(+), 1 deletion(-)
 create mode 100644 tests/data/test2008

diff --git a/src/tool_operate.c b/src/tool_operate.c
index c4439da8e7..81a58ab230 100644
--- a/src/tool_operate.c
+++ b/src/tool_operate.c
@@ -847,7 +847,8 @@ static CURLcode append2query(struct OperationConfig *config,
       char *updated = NULL;
       uerr = curl_url_set(uh, CURLUPART_QUERY, q, CURLU_APPENDQUERY);
       if(!uerr)
-        uerr = curl_url_get(uh, CURLUPART_URL, &updated, CURLU_GUESS_SCHEME);
+        uerr = curl_url_get(uh, CURLUPART_URL, &updated,
+                            CURLU_NO_GUESS_SCHEME);
       if(uerr)
         result = urlerr_cvt(uerr);
       else {
diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am
index 67c7b123c9..ffb1d38250 100644
--- a/tests/data/Makefile.am
+++ b/tests/data/Makefile.am
@@ -245,6 +245,7 @@ test1970 test1971 test1972 test1973 test1974 test1975 test1976 test1977 \
 test1978 test1979 test1980 test1981 \
 \
 test2000 test2001 test2002 test2003 test2004 test2005 test2006 test2007 \
+test2008 \
 \
                                                                test2023 \
 test2024 test2025 test2026 test2027 test2028 test2029 test2030 test2031 \
diff --git a/tests/data/test2008 b/tests/data/test2008
new file mode 100644
index 0000000000..a24a019356
--- /dev/null
+++ b/tests/data/test2008
@@ -0,0 +1,49 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+-G
+--proto-default
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 200 OK
+Content-Length: 6
+Funny-head: yesyes
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<features>
+proxy
+</features>
+<server>
+http
+</server>
+<name>
+-G with --proto-default=http and scheme-less URL starting with "ftp"
+</name>
+<command>
+ftp.test --proto-default=http --resolve ftp.test:80:%HOSTIP -G -d hello -x http://%HOSTIP:%HTTPPORT/
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET http://ftp.test/?hello HTTP/1.1
+Host: ftp.test
+User-Agent: curl/%VERSION
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+</protocol>
+</verify>
+</testcase>