Commit graph

38362 commits

Author SHA1 Message Date
Daniel Stenberg
b240c5292c
badwords: detect the the and with with
They seem to be the most common mistaken repeated words

Ref #20933

Closes #20934
2026-03-16 11:01:19 +01:00
Daniel Stenberg
0cd0e193d3
url: use URL for url even in comments
(Missed in CI due to a bug, see #20934)

Closes #20935
2026-03-16 10:51:02 +01:00
Martin Dürrmeier
594a9276bc
docs/lib: fix typos
Repated 'the the' and 'with with'

Closes #20933
2026-03-16 10:43:24 +01:00
Stefan Eissing
eb14705280
protocol source, all about protocols and uri schemes
Add protocol.h and protocol.c containing all about libcurl's
known URI schemes and their protocol handlers (so they exist).

Moves the scheme definitions from the various sources files into
protocol.c. Schemes are known and used, even of the protocol
handler is not build or just not implemented at all.

Closes #20906
2026-03-16 08:39:02 +01:00
Daniel Stenberg
32531f20f9
doh: fix memory-leak when doing a second DoH resolve
Reported-by: James Fuller
Closes #20929
2026-03-16 00:20:18 +01:00
Stefan Eissing
f50446f6da
lib: keepon improving
Improve the name, type and handling of `data->req.keepon`:

- Rename `keepon` to `io_flags`
- make `io_flags` and `uint8_t` and reposition in struct
- Rename `KEEP_*` defines to `REQ_IO_*`, move to request.h
- Replace all direct bit tests to `CURL_REQ_WANT_*` use
- Replace all direct bit manipulations with new macros

Closes #20905
2026-03-15 12:48:03 +01:00
Stefan Eissing
9325eb5fc4
urldata: import port types and conn destination format
Convert more `int port` to `uint16_t` port types. Reshuffle ports in
connectdata to save some bytes. Change `conn->destination` format to

- make it more readable and thus usable in tracing
- add the IPv6 scope_id only when not default (global)
  and make it resemble more the textual format for IPv6
  (e.g. suffix '%<scope_id>')

Closes #20918
2026-03-15 12:02:26 +01:00
crawfordxx
dfadec7ec3
os400sys: fix typo in comment (symetry -> symmetry)
Closes #20923
2026-03-15 12:00:08 +01:00
Stefan Eissing
412cd2577a
urldata: connection bit ipv6_ip is wrong
Eliminate `conn->bits.ipv6_ip`

The bit was only correct for the first transfer using a connection. Use
`data->state.up.hostname` instead in places that need the URL hostname
in its original form.

Fix parseurlandfillconn() to not modify `data->state.up.hostname` before
copying the connection's hostname, but modify the copy instead, leaving
the URL hostname intact.

Closes #20919
2026-03-14 23:17:40 +01:00
Daniel Stenberg
eb5af3a9c7
GHA: make typos ignore RELEASE-NOTES
The file is almost entirely made up by first-lines of previous git
commits, and we usually push it without a PR cycle, making it annoying
to trigger on typos later as they then show in independent PRs by other
people.

Closes #20917
2026-03-13 13:12:21 +01:00
Daniel Stenberg
a254b8ce3f
RELEASE-NOTES: fix typo 2026-03-13 10:25:27 +01:00
Daniel Stenberg
6870803187
badwords: only check comments and strings in source code
- when scanning source code, this now only checks source code comments
  and double-quote strings. No more finding bad words as part of code
- this allows the full scan to be done in a single invocation
- detects source code or markdown by file name extension
- moved the whitelist words config into the single `badwords.txt` file,
  no more having them separately (see top of file for syntax)
- all whitelisted words are checked case insensitively now
- removed support for whitelisting words on a specific line number. We
  did not use it and it is too fragile

Removing the actual code from getting scanned made the script take an
additional 0.5 seconds on my machine.

Scanning 1525 files now takes a little under 1.7 seconds for me.

Closes #20909
2026-03-13 08:54:35 +01:00
Daniel Stenberg
2b3438d486
tool_cfgable: free the SSL signature algorithms
Follow-up to a638828c88
Reported-by: James Fuller
Closes #20915
2026-03-12 23:45:38 +01:00
Daniel Stenberg
c2f36b6c4b
RELEASE-NOTES: synced 2026-03-12 23:32:25 +01:00
Daniel Stenberg
510efa0007
HTTP3.md: drop outdated mentions of OpenSSL-QUIC
And make it a little clearer that the quiche backend is what is still
experimental.

Follow-up to 6aaac9dd38

Closes #20914
2026-03-12 23:20:47 +01:00
Viktor Szakats
666db80196
configure: fix LibreSSL ngtcp2 1.15.0+ crypto lib selection logic
Regression since curl 8.18.0.

Reported-by: Michael Hendricks
Fixes #20889
Regression from 8db0e286b3 #18189

Closes #20891
2026-03-12 23:13:03 +01:00
Viktor Szakats
210d8eca5b
build: compiler warning silencing tidy-ups
- tool_getparam: revert an unnecessary/no-op C89 warning silencer.
  Follow-up to 09c9afdd71 #20363

- tool_writeout: add comment saying silencing is a no-op for llvm/clang.
  For `strftime()` it is a GCC-specific, as of llvm/clang v22.1.0.
  Follow-up to f07a98ae11 #20366

- unit1652: drop always-false `!defined(__clang__)` guard.
  Pointed-out-by: Orgad Shaneh
  Ref: #20902
  Follow-up to 7e814c8717 #16062

- unit1652: document that `-Wformat` is necessary for GCC v5 to v8.
  Follow-up to 71cf0d1fca #14772

Closes #20908
2026-03-12 19:02:43 +01:00
Daniel Stenberg
d20fa5cd39
test459: switch to mode="warn" for stderr check
In a -j192 build, this output used a three-digit number for the output,
thus wrapping differently and causing it to error.

Reported-by: Carlos Henrique Lima Melara

Closes #20910
2026-03-12 16:55:07 +01:00
Daniel Stenberg
143279faf4
test1627: Curl_get_scheme unit test
Closes #20904
2026-03-12 14:22:38 +01:00
Daniel Stenberg
9148862c26
test1626: Curl_copy_header_value unit test
Closes #20903
2026-03-12 13:59:59 +01:00
Viktor Szakats
7a4fa90048
openssl: trace count of found / imported Windows native CA roots
To help understanding what's happening on systems where native CA misses
to verify legitimate public websites.

Also:
- drop a superfluous, hanging, `else`.

Ref: #20897

Closes #20899
2026-03-12 10:49:21 +01:00
Daniel Stenberg
133b125b89
http: make Curl_compareheader handle multiple commas in header
For robustness
2026-03-12 10:30:18 +01:00
Daniel Stenberg
ed7bfcd17d
test1625: unit test for Curl_compareheader
Follow-up to 2938cb72e5

Closes #20901
2026-03-12 10:30:14 +01:00
Daniel Stenberg
c0f17dee36
hostip: remove two zero assigns after memset clear
As the struct is now always unconditionally memset with zeros, we
can remove two zero assigns.

Follow-up to 015f1c7de4

Pointed out by CodeSonar

Closes #20900
2026-03-12 08:47:02 +01:00
Daniel Stenberg
2938cb72e5
http: fix Curl_compareheader for multi value headers
Follow-up to 04289c62de. Regression shipped in 8.13.0.

- a logic error made it not loop and thus only match if the searched string
  was first

- it no longer matches a substring

Adjusted test 1 to use multiple values in the Connection: response
header. Adjusted test 1542 to have a "Connection: close-not" which
should not match.

Reported-by: Henrique Pereira

Closes #20894
2026-03-12 07:52:58 +01:00
Viktor Szakats
6ada2e3dce
autotools: limit checksrc target to ignore non-repo test sources
Syncing tests with lib and src behavior.

Also:
- fix OS400 checksrc to find the per-directory `.checksrc` file.

Closes #20898
2026-03-12 01:45:24 +01:00
Viktor Szakats
a0db67572e
build: hook up badwords check to lint targets
Also:
- autotools: make `badwords` target honor `@PERL@`.

Suggested-by: Stefan Eissing

Closes #20884
2026-03-12 01:25:42 +01:00
Viktor Szakats
56739855f3
examples: drop warning silencers no longer hit
Also:
- scope clang `-Wcast-function-type-strict` silencing, add missed `pop`.

Follow-up to d06b49d8b2 #18260

Closes #20896
2026-03-12 01:01:16 +01:00
Viktor Szakats
435eabeac8
badwords: rework exceptions, fix many of them
Also:
- support per-directory and per-upper-directory whitelist entries.
- convert badlist input grep tweak into the above format.
  (except for 'And' which had just a few hits.)
- fix many code exceptions, but do not enforce.
  (there also remain about 350 'will' uses in lib)
- fix badwords in example code, drop exceptions.
- badwords-all: convert to Perl.
  To make it usable from CMake.
- FAQ: reword to not use 'will'. Drop exception.

Closes #20886
2026-03-12 01:01:16 +01:00
Daniel Stenberg
11c14b5ca5
urlapi: verify the last letter of a scheme when set explictly
A logic error made the function not check the last character, which thus
could make it accept invalid schemes.

Added test 1965 to verify

Reported-by: Otis Cui Lei

Closes #20893
2026-03-11 23:48:53 +01:00
Stefan Eissing
5fc7d50cec
vtls: ECH definitions cleanup
- Move ECH related defines to vtls.h
- Prefix all defines with `CURLECH_`
- Move base64.h include from vtls.h to implementations

Closes #20887
2026-03-11 23:45:29 +01:00
Stefan Eissing
f14ce01369
pingpong: cleanup timeleft handling
- Move `RESP_TIMEOUT` from urldata.h to pingpong.h as
  `PINGPONG_TIMEOUT_MS`.
- Rename `Curl_pp_state_timeout()` to `Curl_pp_state_timeleft_ms()` as
  the function returns the time left, not the timout..
- Update implementation comments and variable names

Closes #20888
2026-03-11 23:30:05 +01:00
Stefan Eissing
da7bfb89a1
connection_check, simplified
The protocol handler method `connection_check` allowed to variable
operations to trigger with variable result bits. Only the `CONNCHECK_ISDEAD`
and `CONNRESULT_DEAD` were in use. Transform the function into
`connection_is_dead` without extra parameter and a bool result.

- Remove defines for `CONNCHECK_*` and `CONNRESULT_*`
- Rename protocol function in handler comments
- Change RTSP implementation (only protocol that uses this)

Closes #20890
2026-03-11 23:28:50 +01:00
Vladimír Marek
015f1c7de4
hostip: clear the sockaddr_in6 structure before use
On Solaris this was causing intermittent issues when the private
structure member __sin6_src_id had unexpectedly some value. connect(2)
would then fail with EADDRNOTAVAIL.

Closes #20885
2026-03-11 11:33:13 +01:00
Daniel Stenberg
53a3b2114a
libssh2: fix error handling on quote errors
Previously it lacked the actual return. libssh.c uses the same function
name.

Verified by test 2007.

Reported-by: m777m0 on hackerone

Follow-up to 578706adde

Closes #20883
2026-03-11 09:44:21 +01:00
Daniel Stenberg
a221e2fbff
RELEASE-NOTES: synced
Bumped curlver as well
2026-03-11 08:49:39 +01:00
Daniel Stenberg
1a4d392046
docs: minor wording tweaks
found when improving the badwords whitelisting logic
2026-03-11 08:46:01 +01:00
Daniel Stenberg
2e52a57107
badwords: combine the whitelisting into a single regex
Also: make the whitelist matches case insensitve

Takes the script execution time down from 3.6 seconds to 1.1 on my
machine.

Closes #20880
2026-03-11 08:45:54 +01:00
Daniel Stenberg
8c908d2d0a
RELEASE-NOTES: synced
curl 8.19.0
2026-03-11 07:46:12 +01:00
Daniel Stenberg
7a73be1f95
VERSIONS: add 8.19.0 2026-03-11 07:46:12 +01:00
Daniel Stenberg
3fd0d776d1
THANKS: add contributors from 8.19.0 release 2026-03-11 07:46:12 +01:00
Viktor Szakats
18e8c9f455
FAQ.md: point codeproject.com URL to archive.org copy
The original server closed down, linked page last seen on 2026-02-16.

Refs:
https://github.com/curl/curl/actions/runs/22051494128
https://web.archive.org/web/20250818150617/www.codeproject.com/info/Changes.aspx

Closes #20882
2026-03-11 01:48:21 +01:00
Felipe Mesquita
f25124338c
badwords: avoid 'simply'
It's mostly a filler word. I've read through each use of it in the code
base and did minor rephrasings when "simply" carried some meaning. The
overwhelming majority of cases, removing it improved the text
significantly. Inspired by #20793.

Closes #20822
2026-03-10 19:34:06 +01:00
Viktor Szakats
4021c6e673
badwords: fix showing alternative for case-insensitive hits
Fixing:
```
Use of uninitialized value $alt{"Simply"} in printf at scripts/badwords line 109, <F> line 34.
 maybe use "" instead?
```

Closes #20879
2026-03-10 18:38:29 +01:00
Viktor Szakats
15932f2ac5
GHA: drop installing impacket for curl built without SMB support
Ref: #20846

Closes #20868
2026-03-10 17:45:27 +01:00
Viktor Szakats
3b43b9080d
badwords: dedupe invocation into a runnable script
Also:
- GHA/checksrc: merge two badwords CI jobs into a single one.
- re-add the more common bitness entries.

Closes #20874
2026-03-10 17:44:15 +01:00
Viktor Szakats
d4a06862cb
spacecheck: find double newlines in tests/data/test*
Closes #20872
2026-03-10 17:44:15 +01:00
Daniel Stenberg
ed7bf43a08
BUG-BOUNTY.md: minor rephrase to say there is no bug bounty
also add a brief mention to VULN-DISCLOSURE-POLICY.md

Closes #20878
2026-03-10 17:34:08 +01:00
renovate[bot]
a4f90969ff
GHA: update awslabs/aws-lc to v1.69.0
Closes #20876
2026-03-10 16:08:44 +01:00
Stefan Eissing
c1cea52f12
badwords: twice as fast
...on my macOS machine, this version uses half the time when
scanning the source.

Closes #20877
2026-03-10 16:07:15 +01:00