romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-29 21:28:07 +03:00
Code Issues Projects Releases Packages Wiki Activity

cookie: tailmatch the domains for secure override

Browse source 
If a SECURE cookie is set for a sub-domain (`example.com`) and is then
attempted to get set again for more specific part of that domain
(`www.example.com`) without the SECURE property, the second occurance
should not be allowed.

Reported-by: Trail of Bits

Verified by test 3305
Closes #21910
This commit is contained in:
Daniel Stenberg 2026-06-08 16:37:44 +02:00
parent 952b04474c
commit e66b81a532
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
3 changed files with 89 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

6
lib/cookie.c
View file

@ -863,8 +863,10 @@ static bool replace_existing(struct Curl_easy *data,
bool matching_domains = FALSE;
if(clist->domain && co->domain) {
if(curl_strequal(clist->domain, co->domain))
/* The domains are identical */
if(cookie_tailmatch(clist->domain, strlen(clist->domain),
co->domain) ||
cookie_tailmatch(co->domain, strlen(co->domain), clist->domain))
/* The existing one is a tail of the new or vice versa */
matching_domains = TRUE;
}
else if(!clist->domain && !co->domain)