romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-24 13:03:35 +03:00
Code Issues Projects Releases Packages Wiki Activity

http: trim custom header name before the Authorization drop

Browse source 
A custom header name padded with blanks (`Authorization :`) missed the
exact-length compare and slipped past the cross-host Authorization and
Cookie drop, forwarding the header to the redirect target. Trim the
parsed name in both the request and proxy CONNECT header builders.

Closes #22178
This commit is contained in:
Alhuda Khan 2026-06-26 02:18:07 +05:30 • committed by Daniel Stenberg
parent 18475e662c
commit a36384ab94
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
4 changed files with 104 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
lib/http_proxy.c
View file

@ -129,6 +129,9 @@ static CURLcode dynhds_add_custom(struct Curl_easy *data,
continue;
DEBUGASSERT(curlx_strlen(&name) && value);
/* trim surrounding whitespace so a padded field name (e.g.
`Authorization :`) cannot slip past the Authorization/Cookie check */
curlx_str_trimblanks(&name);
if(data->state.aptr.host &&
/* a Host: header was sent already, do not pass on any custom Host:
header as that will produce *two* in the same request! */