romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 10:53:37 +03:00
Code Issues Projects Releases Packages Wiki Activity

cookie: tailmatch the domains for secure override

Browse source 
If a SECURE cookie is set for a sub-domain (`example.com`) and is then
attempted to get set again for more specific part of that domain
(`www.example.com`) without the SECURE property, the second occurance
should not be allowed.

Reported-by: Trail of Bits

Verified by test 3305
Closes #21910
This commit is contained in:
Daniel Stenberg 2026-06-08 16:37:44 +02:00
parent 952b04474c
commit e66b81a532
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
3 changed files with 89 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

2
tests/data/Makefile.am
View file

@ -283,7 +283,7 @@ test3200 test3201 test3202 test3203 test3204 test3205 test3206 test3207 \
test3208 test3209 test3210 test3211 test3212 test3213 test3214 test3215 \
test3216 test3217 test3218 test3219 test3220 test3221 \
\
test3300 test3301 test3302 test3303 test3304 \
test3300 test3301 test3302 test3303 test3304 test3305 \
\
test3400 \
\