romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-26 05:43:31 +03:00
Code Issues Projects Releases Packages Wiki Activity

http: trim custom header name before the Authorization drop

Browse source 
A custom header name padded with blanks (`Authorization :`) missed the
exact-length compare and slipped past the cross-host Authorization and
Cookie drop, forwarding the header to the redirect target. Trim the
parsed name in both the request and proxy CONNECT header builders.

Closes #22178
This commit is contained in:
Alhuda Khan 2026-06-26 02:18:07 +05:30 • committed by Daniel Stenberg
parent 18475e662c
commit a36384ab94
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
4 changed files with 104 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

6
lib/http.c
View file

@ -1805,6 +1805,12 @@ CURLcode Curl_add_custom_headers(struct Curl_easy *data,
continue;
}
/* a field name is a token and carries no surrounding whitespace, so
trim the parsed name before matching. Otherwise `Authorization :`
(space before the colon) slips past the Authorization/Cookie check
below and gets forwarded to another host on a redirect. */
curlx_str_trimblanks(&name);
/* only send this if the contents was non-blank or done special */
if(data->state.aptr.host &&