romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-22 23:17:17 +03:00
Code Issues Projects Releases Packages Wiki Activity

cookies: do not assume a valid domain has a dot

Browse source 
This repairs cookies for localhost.

Non-PSL builds will now only accept "localhost" without dots, while PSL
builds okeys everything not listed as PSL.

Added test 1258 to verify.

This was a regression brought in a76825a5ef
This commit is contained in:
Daniel Stenberg 2017-01-27 12:59:12 +01:00
parent 074405786b
commit cbd4e1fa0d
3 changed files with 72 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

23
lib/cookie.c
View file

@ -5,7 +5,7 @@
* | (__| |_| | _ <| |___
* \___|\___/|_| \_\_____|
*
* Copyright (C) 1998 - 2016, Daniel Stenberg, <daniel@haxx.se>, et al.
* Copyright (C) 1998 - 2017, Daniel Stenberg, <daniel@haxx.se>, et al.
*
* This software is licensed as described in the file COPYING, which
* you should have received as part of this distribution. The terms
@ -492,7 +492,6 @@ Curl_cookie_add(struct Curl_easy *data,
}
else if(strcasecompare("domain", name)) {
bool is_ip;
const char *dotp;
/* Now, we make sure that our host is within the given domain,
or the given domain is not valid and thus cannot be set. */
@ -500,12 +499,22 @@ Curl_cookie_add(struct Curl_easy *data,
if('.' == whatptr[0])
whatptr++; /* ignore preceding dot */
is_ip = isip(domain ? domain : whatptr);
#ifndef USE_LIBPSL
/*
* Without PSL we don't know when the incoming cookie is set on a
* TLD or otherwise "protected" suffix. To reduce risk, we require a
* dot OR the exact host name being "localhost".
*/
{
const char *dotp;
/* check for more dots */
dotp = strchr(whatptr, '.');
if(!dotp && !strcasecompare("localhost", whatptr))
domain=":";
}
#endif
/* check for more dots */
dotp = strchr(whatptr, '.');
if(!dotp)
domain=":";
is_ip = isip(domain ? domain : whatptr);
if(!domain
|| (is_ip && !strcmp(whatptr, domain))