romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-06 06:56:13 +03:00
Code Issues Projects Releases Packages Wiki Activity

hsts: when a dupe host adds subdomains, use that

Browse source 
Otherwise a weaker earlier entry is allowed to override a later more
restrictive one.

Add test 1638 to verify.

Closes #21108
This commit is contained in:
Daniel Stenberg 2026-03-26 17:28:34 +01:00
parent 5172ba5475
commit e1fdbdd16f
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
6 changed files with 105 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

2
tests/data/Makefile.am
View file

@ -217,7 +217,7 @@ test1614 test1615 test1616 test1617 test1618 \
test1620 test1621 test1622 test1623 test1624 test1625 test1626 test1627 \
\
test1630 test1631 test1632 test1633 test1634 test1635 test1636 test1637 \
\
test1638 \
test1640 test1641 test1642 test1643 \
\
test1650 test1651 test1652 test1653 test1654 test1655 test1656 test1657 \

79
tests/data/test1638 Normal file
View file

@ -0,0 +1,79 @@
<?xml version="1.0" encoding="US-ASCII"?>
<testcase>
<info>
<keywords>
HTTP
HTTP proxy
HSTS
</keywords>
</info>
<reply>
# we use this as response to a CONNECT
<connect crlf="headers" nocheck="yes">
HTTP/1.1 200 not OK at all
Date: Tue, 09 Nov 2010 14:49:00 GMT
Server: test-server/fake
Connection: close
Funny-head: yesyes
</connect>
<data crlf="headers" nocheck="yes">
HTTP/1.1 200 not OK at all
Date: Tue, 09 Nov 2010 14:49:00 GMT
Server: test-server/fake
Content-Length: 6
Connection: close
Funny-head: yesyes
-foo-
</data>
</reply>
<client>
<server>
http
</server>
<features>
HSTS
proxy
https
large-time
</features>
<file name="%LOGDIR/hsts%TESTNUMBER">
# comment in input file
foo.example. "20391001 04:47:41"
.foo.example. "20291001 04:47:41"
</file>
<name>
HSTS duplicate domains where the update adds subdomains
</name>
<command>
-x http://%HOSTIP:%HTTPPORT http://this.hsts.example/%TESTNUMBER --hsts %LOGDIR/hsts%TESTNUMBER
</command>
<disable>
test-duphandle
</disable>
</client>
<verify>
<protocol crlf="headers">
GET http://this.hsts.example/%TESTNUMBER HTTP/1.1
Host: this.hsts.example
User-Agent: curl/%VERSION
Accept: */*
Proxy-Connection: Keep-Alive
</protocol>
<file name="%LOGDIR/hsts%TESTNUMBER" mode="text">
# Your HSTS cache. https://curl.se/docs/hsts.html
# This file was generated by libcurl! Edit at your own risk.
.foo.example "20391001 04:47:41"
</file>
</verify>
</testcase>