romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 23:33:37 +03:00
Code Issues Projects Releases Packages Wiki Activity

transfer: enhance secure check

Browse source 
Introduce `Curl_xfer_is_secure(data)` that returns TRUE for transfers
that happen(ed) over a end-to-end secured connection, e.g. SSL.

Add test1586 to verify behaviour for http: transfers via a https: proxy.

Reported-by: lg_oled77c5pua on hackerone

Closes #20951
This commit is contained in:
Stefan Eissing 2026-03-17 11:40:13 +01:00 • committed by Daniel Stenberg
parent f4c0590b1c
commit adda11330b
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
6 changed files with 104 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

2
tests/data/Makefile.am
View file

@ -208,7 +208,7 @@ test1548 test1549 test1550 test1551 test1552 test1553 test1554 test1555 \
test1556 test1557 test1558 test1559 test1560 test1561 test1562 test1563 \
test1564 test1565 test1566 test1567 test1568 test1569 test1570 test1571 \
test1572 test1573 test1574 test1575 test1576 test1577 test1578 test1579 \
test1580 test1581 test1582 test1583 test1584 test1585 \
test1580 test1581 test1582 test1583 test1584 test1585 test1586 \
\
test1590 test1591 test1592 test1593 test1594 test1595 test1596 test1597 \
test1598 test1599 test1600 test1601 test1602 test1603 test1604 test1605 \

73
tests/data/test1586 Normal file
View file

@ -0,0 +1,73 @@
<?xml version="1.0" encoding="US-ASCII"?>
<testcase>
<info>
<keywords>
HTTP
HTTPS proxy
HSTS
trailing-dot
</keywords>
</info>
<reply>
<data crlf="headers">
HTTP/1.1 200 OK
Content-Length: 6
Strict-Transport-Security: max-age=604800
-foo-
</data>
<data2 crlf="headers">
HTTP/1.1 200 OK
Content-Length: 6
Strict-Transport-Security: max-age=6048000
-baa-
</data2>
</reply>
<client>
<server>
http
https-proxy
</server>
<features>
HSTS
proxy
http
</features>
<setenv>
</setenv>
<name>
HSTS via https: proxy ignored for http: URLs
</name>
<command>
-x https://%HOSTIP:%HTTPSPROXYPORT --proxy-insecure --hsts %LOGDIR/hsts%TESTNUMBER http://this.hsts.example./%TESTNUMBER http://another.example.com/%TESTNUMBER0002
</command>
</client>
<verify>
<proxy crlf="headers">
GET http://this.hsts.example./%TESTNUMBER HTTP/1.1
Host: this.hsts.example.
User-Agent: curl/%VERSION
Accept: */*
Proxy-Connection: Keep-Alive
GET http://another.example.com/%TESTNUMBER0002 HTTP/1.1
Host: another.example.com
User-Agent: curl/%VERSION
Accept: */*
Proxy-Connection: Keep-Alive
</proxy>
# The saved HSTS file must be empty as the HSTS headers were not secured
<file name="%LOGDIR/hsts%TESTNUMBER" mode="text">
# Your HSTS cache. https://curl.se/docs/hsts.html
# This file was generated by libcurl! Edit at your own risk.
</file>
</verify>
</testcase>