romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 15:03:32 +03:00
Code Issues Projects Releases Packages Wiki Activity

transfer: enhance secure check

Browse source 
Introduce `Curl_xfer_is_secure(data)` that returns TRUE for transfers
that happen(ed) over a end-to-end secured connection, e.g. SSL.

Add test1586 to verify behaviour for http: transfers via a https: proxy.

Reported-by: lg_oled77c5pua on hackerone

Closes #20951
This commit is contained in:
Stefan Eissing 2026-03-17 11:40:13 +01:00 • committed by Daniel Stenberg
parent f4c0590b1c
commit adda11330b
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
6 changed files with 104 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

6
lib/http.c
View file

@ -3219,7 +3219,7 @@ static CURLcode http_header_a(struct Curl_easy *data,
const char *v;
struct connectdata *conn = data->conn;
v = (data->asi &&
(Curl_conn_is_ssl(data->conn, FIRSTSOCKET) ||
(Curl_xfer_is_secure(data) ||
#ifdef DEBUGBUILD
/* allow debug builds to circumvent the HTTPS restriction */
getenv("CURL_ALTSVC_HTTP")
@ -3573,7 +3573,7 @@ static CURLcode http_header_s(struct Curl_easy *data,
#ifndef CURL_DISABLE_HSTS
/* If enabled, the header is incoming and this is over HTTPS */
v = (data->hsts &&
(Curl_conn_is_ssl(conn, FIRSTSOCKET) ||
(Curl_xfer_is_secure(data) ||
#ifdef DEBUGBUILD
/* allow debug builds to circumvent the HTTPS restriction */
getenv("CURL_HSTS_HTTP")
@ -4906,7 +4906,7 @@ CURLcode Curl_http_req_to_h2(struct dynhds *h2_headers,
infof(data, "set pseudo header %s to %s", HTTP_PSEUDO_SCHEME, scheme);
}
else {
scheme = Curl_conn_is_ssl(data->conn, FIRSTSOCKET) ? "https" : "http";
scheme = Curl_xfer_is_secure(data) ? "https" : "http";
}
}