Commit graph

36949 commits

Author SHA1 Message Date
Viktor Szakats
2decbb1c1f
runtests: add -m=seconds to override test curl command timeout
To override the curl default of 5 minutes (300000 ms).

Sometimes a simple test data change can result in a stuck test, this
option makes it exit with an error early. Possible future use in CI
or fast machines to prevent a single test taking 5 minutes and failing
the whole job.

Example hangers:

tests/data/test65:
```diff
-<data1000 crlf="yes">
+<data1000 crlf="headers">
```

tests/data/tests993:
```diff
-%repeat[1000 x 95 328485%0d%0a]%</data>
+%repeat[1000 x 95 328485%0d%0a]%
+</data>
```

Closes #19319
2025-11-19 22:04:52 +01:00
Christian Schmitz
991119051c
libssh2: add paths to error messages for quote commands
We really like to know what path curl parsed from our input.

Closes #19605
2025-11-19 16:25:07 +01:00
Stefan Eissing
17dc43ce6c
http: eliminate ssize_t
Use size_t to avoid conversions.

Closes #19610
2025-11-19 16:20:18 +01:00
Stefan Eissing
30afc66b88
gopher: convert ssize_t to size_t
Make type conversions unnecessary.

Closes #19608
2025-11-19 16:18:22 +01:00
Stefan Eissing
9fb843ac8f
ftp: use size_t instead of ssize_t
Make type conversions unnecessary.

Closes #19607
2025-11-19 16:16:20 +01:00
Viktor Szakats
47b8e1dbd3
tidy-up: move CURL_UNCONST() out from macro curl_unicodefree()
To stop applying it where not needed (most uses) and make it visible
where it's actually used (5 uses).

Follow-up to f4e23950c7 #16142

Closes #19606
2025-11-19 15:48:21 +01:00
Viktor Szakats
b0d23b901f
GHA: set --buildinfo for test-torture jobs
Only the `test-ci` build target sets `--buildinfo` automatically,
since 985f39c0ce. It needs to be set
manually for other targets used in CI, such as `test-torture`,
to enable the `buildinfo.txt` dump in the runtests step.

For Test Clutch. In an attempt to re-sync `targetarch` with the rest of
macOS jobs on the feature matrix page:
https://testclutch.curl.se/static/reports/feature-matrix.html
Before this patch and possibly since the breaking update It's `aarch64e`
for torture jobs and `aarch64` for the rest

(stricly speaking `aarch64e` is the correct value for all macOS jobs, but
autotools and cmake report arm64/aarch64 without the `e`.)

Regression from 985f39c0ce #18147

Closes #19601
2025-11-19 15:48:20 +01:00
Daniel Stenberg
b98e791e57
test777: simple ---ssl-sessions test with wrong sessions 2025-11-19 12:58:24 +01:00
Daniel Stenberg
abe6ea0531
curlinfo: add "ssl-sessions" as a feature to show
To allow tests depend on it
2025-11-19 12:58:24 +01:00
Daniel Stenberg
c255d2fdcb
tool_cfgable: free ssl-sessions at exit
Also free the memory correctly in tool_ssls_load

Closes #19602
2025-11-19 12:58:15 +01:00
Viktor Szakats
8bb8984e9d
curl_setup.h: document more funcs flagged by _CRT_SECURE_NO_WARNINGS
Based on these logs (non-Unicode, Unicode Schannel):
https://github.com/curl/curl/actions/runs/19446115443/job/55640968722?pr=19175
https://github.com/curl/curl/actions/runs/19446115443/job/55640968764?pr=19175

Follow-up to 5fa2d8320c #19175

Closes #19597
2025-11-19 01:48:20 +01:00
Viktor Szakats
7f3731ce14
tests/data: mark non-XML-compliant files as such, xmllint the rest in CI
There are 58 non-compliant files. Mark them with the `notxml` keyword.
Also include the compliant ones in the GHA/checksrc xmllint CI job.

Also:
- delete XML prolog from the 3 test data files that had them.
- FILEFORMAT.md: document the `notxml` keyword.
- FILEFORMAT.md: fix a typo.

Follow-up to de49cc89ab #19470
Follow-up to f3095f0dbd #19528
Follow-up to 87ba80a6df

Closes #19595
2025-11-19 00:02:45 +01:00
Viktor Szakats
36d0f12881
DISTROS.md: add OpenBSD
Closes #19596
2025-11-19 00:02:45 +01:00
Daniel Stenberg
318cd4f2ee
lib: error for OOM when extracting URL query
Closes #19594
2025-11-18 23:42:24 +01:00
Viktor Szakats
9726fc8259
test2405, 2407: mark tests based on lib2405 flaky
Flaky in macOS CI jobs.

2405:
https://github.com/curl/curl/actions/runs/19448567968/job/55648448197 CM gcc-13 aws-lc
https://github.com/curl/curl/actions/runs/19432797208/job/55595742192 AM clang !ssl
https://github.com/curl/curl/actions/runs/19431697816/job/55591941993 AM clang !ssl !debug brotli zstd
https://github.com/curl/curl/actions/runs/19421214342/job/55558775785 CM llvm@18 GnuTLS !ldap krb5 +examples
https://github.com/curl/curl/actions/runs/19413038235/job/55537174590 CM llvm@18 mbedTLS !ldap brotli zstd MultiSSL AppleIDN

2407:
https://github.com/curl/curl/actions/runs/19462732039/job/55691022408 AM clang !ssl
https://github.com/curl/curl/actions/runs/19440283144/job/55621665647 CM gcc-13 OpenSSL gsasl rtmp AppleIDN SecTrust +examples
https://github.com/curl/curl/actions/runs/19440283144/job/55621665682 AM gcc-13 !ssl !debug
https://github.com/curl/curl/actions/runs/19436530386/job/55608724437 CM gcc-13 aws-lc
https://github.com/curl/curl/actions/runs/19436530386/job/55608724641 CM llvm@18 GnuTLS !ldap krb5 +examples
https://github.com/curl/curl/actions/runs/19435651588/job/55605648449 CM llvm@18 OpenSSL gsasl rtmp AppleIDN SecTrust +examples

Ref: https://testclutch.curl.se/static/reports/results-count.html

Bug: https://github.com/curl/curl/pull/19487#issuecomment-3546858203
Bug: https://github.com/curl/curl/pull/19487#issuecomment-3546921877

Follow-up to 2c7e1792a0 #19487
Follow-up to 96a5ce5a82 #19481
Follow-up to c78044c07e #15146 #15155

Closes #19587
2025-11-18 21:27:44 +01:00
Viktor Szakats
de49cc89ab
tests/data: more XML-compliance via %LT and %GT macros in email addresses
Reduce number of files failing `xmllint --format` from 133 to 57 (-76)
(3% of 1894), by replacing `<` and `>` with new macro `%LT` and `%GT`,
in most places, which is in email addresses (192 lines).

Follow-up to a9ec2a676c #19491

Closes #19470
2025-11-18 18:57:53 +01:00
Daniel Stenberg
97169a91d9
hsts: propagate and error out correctly on OOM
Closes #19593
2025-11-18 16:40:32 +01:00
Daniel Stenberg
80005b4c8a
cookie: return error on OOM
Follow-up to 3f0629ca44
Closes #19591
2025-11-18 15:57:05 +01:00
Daniel Stenberg
6dac2631df
url: if OOM in parse_proxy() return error
Closes #19590
2025-11-18 14:54:16 +01:00
Daniel Stenberg
833efb437d
openssl: exit properly on OOM when getting certchain
Previously, a momentary OOM error in the middle could produce a broken
result instead of correctly returning error.

Closes #19471
2025-11-18 13:04:19 +01:00
Daniel Stenberg
88024c6d39
tool_getparam: verify that a file exists for some options
Passing the option as-is to libcurl is fine, but checking that the file
exists allows the tool to better provide a helpful message.

This now done for the following options:

  --cacert, --crlfile, --knownhosts, --netrc-file, --proxy-cacert amd
  --proxy-crlfile

Bonus: bail out properly on OOM errors in the --cert parser.

Reported-by: Wesley Moore
Fixes #19583
Closes #19585
2025-11-18 11:37:08 +01:00
Viktor Szakats
54a3f63520
GHA: reduce timeouts for Linux and macOS jobs
Also syncing the run tests timeout in GHA/linux with GHA/maos.

Closes #19582
2025-11-18 11:20:01 +01:00
Daniel Stenberg
1cbe510d8b
TEST-SUITE.md: correct the man page's path
Closes #19586
2025-11-18 11:02:17 +01:00
boingball
a41cea7d67
AmigaOS: increase minimum stack size for tool_main
In testing, the older stack size of 16384 was causing curl to crash on
heavy TLS loads

Closes #19578
2025-11-18 07:54:11 +01:00
Viktor Szakats
3c7cf8eac3
examples: tidy-up headers and includes
To have a more similar layout across examples.

Closes #19580
2025-11-18 02:05:07 +01:00
Viktor Szakats
0a2618b265
examples: make functions/data static where missing
Also to avoid compiler warnings on missing declarations.
Missed by CI for these "complicated" examples.

Closes #19579
2025-11-18 01:05:14 +01:00
Viktor Szakats
5fa2d8320c
build: tidy-up MSVC CRT warning suppression macros
- curl_setup.h: replace `_CRT_SECURE_NO_DEPRECATE` with
  `_CRT_SECURE_NO_WARNINGS`, which seems to be the preferred,
  more recent macro for this. Also syncing with libssh2.
  They are equivalent for curl sources with the supported compilers.
- cmake: stop setting `_CRT_SECURE_NO_DEPRECATE` globally for examples.
- examples: suppress CRT deprecation warnings on a per-file basis.
  To make it work when compiling examples out of curl's build systems.
  Use `_CRT_SECURE_NO_WARNINGS`.
- examples: document the functions requiring `_CRT_SECURE_NO_WARNINGS`.
- examples/block_ip: delete superfluous `_CRT_SECURE_NO_WARNINGS`.
- examples/block_ip: limit `_CRT_NONSTDC_NO_DEPRECATE` to MSVC.
- examples/log_failed_transfers: fix to set `_CRT_SECURE_NO_WARNINGS`
  before headers and limit to MSVC.
- curl_setup.h: document which SDKs support `_CRT_NONSTDC_NO_DEPRECATE`.

Closes #19175
2025-11-18 00:49:26 +01:00
Viktor Szakats
1e1ec7f6c2
badwords: add more contractions, fix fallouts
Also fix hits in autotools scripts (not to enforce).

Closes #19576
2025-11-17 19:29:15 +01:00
Viktor Szakats
ad35ecba97
badwords: fix issues found in scripts and other files
Single pass, not enforced.

Also:
- pyspelling.words: drop `web page`

Closes #19572
2025-11-17 17:18:07 +01:00
Viktor Szakats
42c43f695c
renovate.json: replace CI: prefix with GHA:
All bumped dependencies are in GHA.

Follow-up to 6225d7ba2f #19547
2025-11-17 16:50:20 +01:00
renovate[bot]
39320e1e1b
GHA: update dependencies
- github/codeql-action to 4.31.3
- google/boringssl to v0.20251110.0
- ruff to 0.14.5

Closes #19442
Closes #19455
2025-11-17 16:48:56 +01:00
Daniel Stenberg
b360fc62fb
http: avoid two strdup()s and do minor simplifications
Closes #19571
2025-11-17 16:43:01 +01:00
Viktor Szakats
142fd1cf32
appveyor: add VS2010 x86 Release VS project job and switch VS2013 to x64
To have a test case for VS2010 after bumping to minimum Vista.

Ref: #18009
Closes #19570
2025-11-17 15:50:24 +01:00
Stefan Eissing
ea105708c9
h2/h3: handle methods with spaces
The parsing of the HTTP/1.1 formatted request into the h2/h3 header
structures should detect CURLOPT_CUSTOMREQUEST methods and forward them
correctly.

Add test_01_20 to verify

Fixes #19543
Reported-by: Omdahake on github
Closes #19563
2025-11-17 15:43:28 +01:00
Daniel Stenberg
2459dc7a22
http: the :authority header should never contain user+password
Pointed-out-by: Stanislav Fort
Closes #19568
2025-11-17 15:19:39 +01:00
Viktor Szakats
4075339db2
projects/README.md: Markdown fixes
Closes #19569
2025-11-17 15:09:09 +01:00
x2018
821cba8fac
digest_sspi: fix a memory leak on error path
Closes #19567
2025-11-17 14:46:30 +01:00
x2018
11c0aaa339
openssl: fix a potential memory leak of bio_out
Closes #19561
2025-11-17 14:44:34 +01:00
x2018
22b8a6430d
openssl: fix a potential memory leak of params.cert
Closes #19560
2025-11-17 14:43:34 +01:00
x2018
a6c940a752
schannel_verify: fix a memory leak of cert_context
Closes #19556
2025-11-17 14:42:21 +01:00
x2018
b42f226b94
libssh: properly free sftp_attributes
Closes #19564
2025-11-17 14:40:39 +01:00
Marcel Raad
e9a973c513
build: exclude clang prereleases from compiler warning options
Starting with clang 18, stable clang releases start with minor version 1.
Exclude pre-releases with minor version 0 from the compiler warning
options for that major version.

This fixes the build with Android NDK r29, which uses a prerelease
version of clang 21 that doesn't know the new options yet.

Closes #19566
2025-11-17 13:43:50 +01:00
Viktor Szakats
1b48c6148a
tidy-up: miscellaneous
- schannel: delete superfluous parenthesis.
- tftp: delete stray space from log output.
- ws: update guard comment.
- docs/examples: constify variables.
- runtests/servers: enclose unknown parameter between quotes.
- scripts/perlcheck.sh: drop redundant grep `-E` option.
- THANKS: move names from comments to THANKS.
- sync `--depth` option style across scripts.
- sync git repo URL ending between some scripts.
- BINDINGS.md: drop protocol from archive.org URL path.
- whitespace, indent, unfold lines.

Closes #19565
2025-11-17 13:32:43 +01:00
Viktor Szakats
a87383828e
badwords: fix issues found in tests
There remain some false positives, hits in test data, and `dir` use,
around 100 issues in total.

There is no plan to enforce badwords on tests.

Also:
- badwords.txt: let a few `manpage[s]` occurrences through
  (in Perl code).

Closes #19541
2025-11-17 13:30:35 +01:00
Viktor Szakats
f0de14168a
cf-socket: limit use of TCP_KEEP* to Windows 10.0.16299+ at runtime
Before this patch `TCP_KEEP*` socket options were unconditionally used
if the build-time SDK supported them. This caused curl logging errors
(or trace messages since #19527) on Windows versions missing support
for them. After this patch, use them only when the runtime environment
supports it and fall back to the alternate method (`SIO_KEEPALIVE_VALS`)
dynamically.

Also:
- log a trace message when using the Win10 method.
- document which SDK versions offer `TCP_KEEP*` macros.

Ref: https://learn.microsoft.com/windows/win32/winsock/ipproto-tcp-socket-options
Ref: https://learn.microsoft.com/windows/win32/winsock/sio-keepalive-vals

Reported-by: Aleksandr Sergeev
Fixes #19520
Follow-up to dc34498d18 #19527
Closes #19559
2025-11-17 12:16:51 +01:00
Viktor Szakats
f2460e2cb5
RELEASE-NOTES: update upcoming removals
Also add a missed commit (noticed by accident)

Closes #19558
2025-11-17 12:16:50 +01:00
Stefan Eissing
217f0e4d59
pytest fixes and improvements
- fix test_17_20 flakiness: the test case did not have `nghttpx` in
  its parameters, causing it to no check if a reload was necessary.
  When that test ran behind one that gave nghttpx another certificate,
  eg. in parallel mode, it used the wrong pinned pubkey.
- Have `env` provide lists of HTTP protocol versions available for
  testing. Replace parameterized tests on a fixed protocol list with
  the dynamic one from env. This makes checks for protocol availability
  in the test function bodies superfluous.

refs #19489
Closes #19540
2025-11-17 08:02:52 +01:00
Daniel Stenberg
b3d4f17e3d
curl_sasl: make Curl_sasl_decode_mech compare case insenstively
The provided mechanisms should be compared case insenstively.

Found by ZeroPath

Closes #19535
2025-11-17 08:01:13 +01:00
Daniel Stenberg
f5fa8048f7
RELEASE-NOTES: synced 2025-11-16 23:38:48 +01:00
x2018
205a8e861f
wolfssl: fix a potential memory leak of session
Closes #19555
2025-11-16 23:32:41 +01:00