romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-28 15:23:11 +03:00
Code Issues Projects Releases Packages Wiki Activity

hsts: make the HSTS read callback handle name dupes

Browse source 
Now the logic for handling name duplicates and picking the longest
expiry and strictest subdomain is the same for the callback as for when
reading from file.

Also strip trailing dots from the hostname added by the callback.

A minor side-effect is that the hostname provided by the callback can
now enable subdomains by starting the name with a dot, but we discourage
using such hostnames in documentation.

Amended test 1915 to verify.

Closes #21201
This commit is contained in:
Daniel Stenberg 2026-04-02 09:16:17 +02:00
parent dc20c91e04
commit e65ba1bd34
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
4 changed files with 99 additions and 82 deletions
Download patch file Download diff file Expand all files Collapse all files

31
docs/libcurl/opts/CURLOPT_HSTSREADFUNCTION.md
View file

@ -42,23 +42,26 @@ Pass a pointer to your callback function, as the prototype shows above.
This callback function gets called by libcurl repeatedly when it populates the
in-memory HSTS cache.
Set the *clientp* argument with the CURLOPT_HSTSREADDATA(3) option
or it is NULL.
Set the *clientp* argument with the CURLOPT_HSTSREADDATA(3) option or it is
NULL.
When this callback is invoked, the *sts* pointer points to a populated
struct: Copy the hostname to *name* (no longer than *namelen*
bytes). Make it null-terminated. Set *includeSubDomains* to TRUE or
FALSE. Set *expire* to a date stamp or a zero length string for *forever*
(wrong date stamp format might cause the name to not get accepted)
When this callback is invoked, the *sts* pointer points to a populated struct:
Copy the hostname to *name* (no longer than *namelen* bytes). Make it
null-terminated. Set *includeSubDomains* to TRUE or FALSE. Set *expire* to a
date stamp or a zero length string for *forever* (wrong date stamp format
might cause the name to not get accepted)
The callback should return *CURLSTS_OK* if it returns a name and is
prepared to be called again (for another host) or *CURLSTS_DONE* if it has
no entry to return. It can also return *CURLSTS_FAIL* to signal
error. Returning *CURLSTS_FAIL* stops the transfer from being performed
and make *CURLE_ABORTED_BY_CALLBACK* get returned.
The callback should return *CURLSTS_OK* if it returns a name and is prepared
to be called again (for another host) or *CURLSTS_DONE* if it has no entry to
return. It can also return *CURLSTS_FAIL* to signal error. Returning
*CURLSTS_FAIL* stops the transfer from being performed and make
*CURLE_ABORTED_BY_CALLBACK* get returned.
This option does not enable HSTS, you need to use CURLOPT_HSTS_CTRL(3) to
do that.
This option does not enable HSTS, you need to use CURLOPT_HSTS_CTRL(3) to do
that.
The hostname provided to libcurl *should not* have a trailing dot nor leading
dot.
# DEFAULT