romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 11:43:36 +03:00
Code Issues Projects Releases Packages Wiki Activity

http: fix httpsig with auth-redir

Browse source 
Do not let unrelated credentials from a redirected URL bypass the
cross-host auth boundary

Verified by test 5023 to 5025

Follow-up to a55731050e

Closes #22395
This commit is contained in:
Daniel Stenberg 2026-07-25 23:48:07 +02:00
parent 6b1ff5407e
commit acf4498381
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
5 changed files with 213 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

15
lib/http.c
View file

@ -672,10 +672,17 @@ static CURLcode output_auth_headers(struct Curl_easy *data,
#endif
#ifndef CURL_DISABLE_HTTPSIG
if((authstatus->picked == CURLAUTH_HTTPSIG) && !proxy) {
auth = "HTTPSIG";
result = Curl_output_httpsig(data);
if(result)
return result;
/* HTTPSIG uses its own configured key material rather than
data->state.creds. Do not let unrelated credentials from a
redirected URL bypass the cross-host auth boundary. */
if(Curl_auth_allowed_to_host(data)) {
auth = "HTTPSIG";
result = Curl_output_httpsig(data);
if(result)
return result;
}
else
authstatus->done = TRUE;
}
else
#endif