tool_operate: reset the URL --url-query between --next

Pointed out by Codex Security

Verify in test 1624
Closes #20802
This commit is contained in:
Daniel Stenberg 2026-03-03 18:50:20 +01:00
parent 3c007d6351
commit 933c34e873
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
4 changed files with 64 additions and 7 deletions

View file

@ -45,7 +45,6 @@ struct State {
struct getout *urlnode;
struct URLGlob inglob;
struct URLGlob urlglob;
char *httpgetfields;
char *uploadfile;
curl_off_t upnum; /* number of files to upload */
curl_off_t upidx; /* index for upload glob */
@ -143,6 +142,7 @@ struct OperationConfig {
char *krblevel;
char *request_target;
char *writeout; /* %-styled format string to output */
char *httpgetfields;
struct curl_slist *quote;
struct curl_slist *postquote;
struct curl_slist *prequote;

View file

@ -1359,8 +1359,8 @@ static CURLcode create_single(struct OperationConfig *config,
global->isatty = orig_isatty;
}
if(state->httpgetfields) {
result = append2query(config, per, state->httpgetfields);
if(config->httpgetfields) {
result = append2query(config, per, config->httpgetfields);
if(result)
return result;
}
@ -1406,7 +1406,7 @@ static CURLcode single_transfer(struct OperationConfig *config,
{
CURLcode result = CURLE_OK;
struct State *state = &global->state;
char *httpgetfields = state->httpgetfields;
char *httpgetfields = config->httpgetfields;
*skipped = *added = FALSE; /* not yet */
@ -1414,7 +1414,7 @@ static CURLcode single_transfer(struct OperationConfig *config,
if(config->use_httpget) {
if(!httpgetfields) {
/* Use the postfields data for an HTTP get */
httpgetfields = state->httpgetfields = config->postfields;
httpgetfields = config->httpgetfields = config->postfields;
config->postfields = NULL;
if(SetHTTPrequest((config->no_body ? TOOL_HTTPREQ_HEAD :
TOOL_HTTPREQ_GET), &config->httpreq))
@ -1425,7 +1425,7 @@ static CURLcode single_transfer(struct OperationConfig *config,
return CURLE_FAILED_INIT;
}
if(!httpgetfields)
state->httpgetfields = config->query;
config->httpgetfields = config->query;
result = set_cert_types(config);
if(result)