romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-24 14:13:32 +03:00
Code Issues Projects Releases Packages Wiki Activity

cookie: use origin scheme for secure context check

Browse source 
`Curl_secure_context()` checked `conn->scheme` to determine if Secure
cookies may be sent. Since 73daec6, `conn->scheme` is set to the proxy's
scheme when using an HTTPS forwarding proxy, causing the function to
return TRUE for HTTP origins. This leaked Secure cookies over the
plaintext connection between proxy and origin.

Use `data->state.origin->scheme` instead, which always reflects the
origin's scheme regardless of proxy configuration.

Not an approved vulnerability because the regression was introduced
after the last release and is not present in any released version.

Verified by test 3401

Follow-up to 73daec6620
Reported-by: daviey on hackerone
URL: https://hackerone.com/reports/3803415
Closes #22024
This commit is contained in:
Dave Walker 2026-06-15 12:57:42 +01:00 • committed by Daniel Stenberg
parent 50ffc359e9
commit b9702f8c48
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
5 changed files with 64 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

5
lib/http.c
View file

@ -2544,7 +2544,7 @@ static CURLcode http_cookies(struct Curl_easy *data,
const char *host = data->req.cookiehost ?
data->req.cookiehost : data->state.origin->hostname;
Curl_share_lock(data, CURL_LOCK_DATA_COOKIE, CURL_LOCK_ACCESS_SINGLE);
result = Curl_cookie_getlist(data, data->conn, &okay, host, &list);
result = Curl_cookie_getlist(data, &okay, host, &list);
if(!result && okay) {
struct Curl_llist_node *n;
size_t clen = 8; /* hold the size of the generated Cookie: header */
@ -3517,7 +3517,6 @@ static CURLcode http_header_s(struct Curl_easy *data,
const char *hd, size_t hdlen)
{
#if !defined(CURL_DISABLE_COOKIES) || !defined(CURL_DISABLE_HSTS)
struct connectdata *conn = data->conn;
const char *v;
#else
(void)data;
@ -3533,7 +3532,7 @@ static CURLcode http_header_s(struct Curl_easy *data,
* real peer hostname. */
const char *host = data->req.cookiehost ?
data->req.cookiehost : data->state.origin->hostname;
const bool secure_context = Curl_secure_context(conn, host);
const bool secure_context = Curl_secure_context(data, host);
CURLcode result;
Curl_share_lock(data, CURL_LOCK_DATA_COOKIE, CURL_LOCK_ACCESS_SINGLE);
result = Curl_cookie_add(data, data->cookies, TRUE, FALSE, v, host,