romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-24 22:53:37 +03:00
Code Issues Projects Releases Packages Wiki Activity

http: trim custom header name before the Authorization drop

Browse source 
A custom header name padded with blanks (`Authorization :`) missed the
exact-length compare and slipped past the cross-host Authorization and
Cookie drop, forwarding the header to the redirect target. Trim the
parsed name in both the request and proxy CONNECT header builders.

Closes #22178
This commit is contained in:
Alhuda Khan 2026-06-26 02:18:07 +05:30 • committed by Daniel Stenberg
parent 18475e662c
commit a36384ab94
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
4 changed files with 104 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

6
lib/http.c
View file

@ -1805,6 +1805,12 @@ CURLcode Curl_add_custom_headers(struct Curl_easy *data,
continue;
}
/* a field name is a token and carries no surrounding whitespace, so
trim the parsed name before matching. Otherwise `Authorization :`
(space before the colon) slips past the Authorization/Cookie check
below and gets forwarded to another host on a redirect. */
curlx_str_trimblanks(&name);
/* only send this if the contents was non-blank or done special */
if(data->state.aptr.host &&

3
lib/http_proxy.c
View file

@ -129,6 +129,9 @@ static CURLcode dynhds_add_custom(struct Curl_easy *data,
continue;
DEBUGASSERT(curlx_strlen(&name) && value);
/* trim surrounding whitespace so a padded field name (e.g.
`Authorization :`) cannot slip past the Authorization/Cookie check */
curlx_str_trimblanks(&name);
if(data->state.aptr.host &&
/* a Host: header was sent already, do not pass on any custom Host:
header as that will produce *two* in the same request! */