romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 20:43:32 +03:00
Code Issues Projects Releases Packages Wiki Activity

transfer: enhance secure check

Browse source 
Introduce `Curl_xfer_is_secure(data)` that returns TRUE for transfers
that happen(ed) over a end-to-end secured connection, e.g. SSL.

Add test1586 to verify behaviour for http: transfers via a https: proxy.

Reported-by: lg_oled77c5pua on hackerone

Closes #20951
This commit is contained in:
Stefan Eissing 2026-03-17 11:40:13 +01:00 • committed by Daniel Stenberg
parent f4c0590b1c
commit adda11330b
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
6 changed files with 104 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

6
lib/http.c
View file

@ -3219,7 +3219,7 @@ static CURLcode http_header_a(struct Curl_easy *data,
const char *v;
struct connectdata *conn = data->conn;
v = (data->asi &&
(Curl_conn_is_ssl(data->conn, FIRSTSOCKET) ||
(Curl_xfer_is_secure(data) ||
#ifdef DEBUGBUILD
/* allow debug builds to circumvent the HTTPS restriction */
getenv("CURL_ALTSVC_HTTP")
@ -3573,7 +3573,7 @@ static CURLcode http_header_s(struct Curl_easy *data,
#ifndef CURL_DISABLE_HSTS
/* If enabled, the header is incoming and this is over HTTPS */
v = (data->hsts &&
(Curl_conn_is_ssl(conn, FIRSTSOCKET) ||
(Curl_xfer_is_secure(data) ||
#ifdef DEBUGBUILD
/* allow debug builds to circumvent the HTTPS restriction */
getenv("CURL_HSTS_HTTP")
@ -4906,7 +4906,7 @@ CURLcode Curl_http_req_to_h2(struct dynhds *h2_headers,
infof(data, "set pseudo header %s to %s", HTTP_PSEUDO_SCHEME, scheme);
}
else {
scheme = Curl_conn_is_ssl(data->conn, FIRSTSOCKET) ? "https" : "http";
scheme = Curl_xfer_is_secure(data) ? "https" : "http";
}
}

3
lib/imap.c
View file

@ -1024,7 +1024,6 @@ static CURLcode imap_state_capability_resp(struct Curl_easy *data,
imapstate instate)
{
CURLcode result = CURLE_OK;
struct connectdata *conn = data->conn;
const char *line = curlx_dyn_ptr(&imapc->pp.recvbuf);
(void)instate;
@ -1076,7 +1075,7 @@ static CURLcode imap_state_capability_resp(struct Curl_easy *data,
line += wordlen;
}
}
else if(data->set.use_ssl && !Curl_conn_is_ssl(conn, FIRSTSOCKET)) {
else if(data->set.use_ssl && !Curl_xfer_is_secure(data)) {
/* PREAUTH is not compatible with STARTTLS. */
if(imapcode == IMAP_RESP_OK && imapc->tls_supported && !imapc->preauth) {
/* Switch to TLS connection now */

22
lib/transfer.c
View file

@ -903,3 +903,25 @@ CURLcode Curl_xfer_pause_recv(struct Curl_easy *data, bool enable)
Curl_pgrsRecvPause(data, enable);
return result;
}
bool Curl_xfer_is_secure(struct Curl_easy *data)
{
const struct Curl_scheme *scheme = NULL;
if(data->conn) {
scheme = data->conn->scheme;
/* if we are connected, but not use SSL, the transfer is not secure.
* This covers an insecure http:// proxy that is not tunneling.
* We enforce tunneling for such cases, but better be sure here. */
if(Curl_conn_is_connected(data->conn, FIRSTSOCKET) &&
!Curl_conn_is_ssl(data->conn, FIRSTSOCKET))
return FALSE;
}
else if(data->info.conn_scheme) { /* was connected once */
scheme = Curl_get_scheme(data->info.conn_scheme);
}
else { /* never connected (yet?) */
DEBUGASSERT(0); /* not implemented, would need to parse URL */
}
return scheme ? (scheme->flags & PROTOPT_SSL) : FALSE;
}

4
lib/transfer.h
View file

@ -143,4 +143,8 @@ bool Curl_xfer_recv_is_paused(struct Curl_easy *data);
CURLcode Curl_xfer_pause_send(struct Curl_easy *data, bool enable);
CURLcode Curl_xfer_pause_recv(struct Curl_easy *data, bool enable);
/* TRUE if the transfer is secure (e.g. TLS) from libcurl to the
* URL's host. */
bool Curl_xfer_is_secure(struct Curl_easy *data);
#endif /* HEADER_CURL_TRANSFER_H */