mirror of
https://github.com/curl/curl.git
synced 2026-08-25 14:53:34 +03:00
curl_get_line: fix potential infinite loop when filename is a directory
Fix potential inifinite loop reading file content with `Curl_get_line()`
when a filename passed via these options are pointing to a directory
entry (on non-Windows):
- `--alt-svc` / `CURLOPT_ALTSVC`
- `-b` / `--cookie` / `CURLOPT_COOKIEFILE`
- `--hsts` / `CURLOPT_HSTS`
- `--netrc-file` / `CURLOPT_NETRC_FILE`
Fix by checking for this condition and silently skipping such filename
without attempting to read content. Add test 1713 to verify.
Mention in cookie documentation as an accepted case, also show a verbose
message when a directory is detected. Extend test 46 to verify if such
failure lets the logic continue to the next cookie file.
Reported-and-based-on-patch-by: Richard Tollerton
Fixes #20823
Closes #20826 (originally-based-on)
Follow-up to 769ccb4d42 #19140
Closes #20873
This commit is contained in:
parent
6d87eb2878
commit
e76968e20d
9 changed files with 116 additions and 61 deletions
|
|
@ -54,7 +54,8 @@ the Netscape format.
|
|||
|
||||
Users often want to both read cookies from a file and write updated cookies
|
||||
back to a file, so using both --cookie and --cookie-jar in the same command
|
||||
line is common.
|
||||
line is common. curl ignores filenames specified with --cookie which do not
|
||||
exist or point to a directory.
|
||||
|
||||
If curl is built with PSL (**Public Suffix List**) support, it detects and
|
||||
discards cookies that are specified for such suffix domains that should not be
|
||||
|
|
|
|||
|
|
@ -58,6 +58,8 @@ list of files to read cookies from.
|
|||
The cookies are loaded from the specified file(s) when the transfer starts,
|
||||
not when this option is set.
|
||||
|
||||
libcurl ignores filenames which do not exist or point to a directory.
|
||||
|
||||
# SECURITY CONCERNS
|
||||
|
||||
This document previously mentioned how specifying a non-existing file can also
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue