moparisthebest/curl
1
0
Fork 0
mirror of https://github.com/moparisthebest/curl synced 2024-11-13 13:05:03 -05:00
Code Issues Releases Wiki Activity
71da3f8307
curl/tests/data/test1218

65 lines
1.2 KiB
Plaintext
Raw Normal View History

test1218: another cookie tailmatch test ... and make 1216 also verify it with a file input These tests verify commit 3604fde3d3c9b0d, the fix for the "cookie domain tailmatch" vulnerability. See http://curl.haxx.se/docs/adv_20130412.html
2013-04-10 07:40:36 -04:00
<testcase>
<info>
<keywords>
HTTP
HTTP GET
HTTP proxy
cookies
</keywords>
</info>
# This test is very similar to 1216, only that it sets the cookies from the
# first site instead of reading from a file
<reply>
<data>
HTTP/1.1 200 OK
Date: Tue, 25 Sep 2001 19:37:44 GMT
cookies: first n/v pair in Set-Cookie: is the cookie, then parameters RFC 6265 section 4.1.1 spells out that the first name/value pair in the header is the actual cookie name and content, while the following are the parameters. libcurl previously had a more liberal approach which causes significant problems when introducing new cookie parameters, like the suggested new cookie priority draft. The previous logic read all n/v pairs from left-to-right and the first name used that wassn't a known parameter name would be used as the cookie name, thus accepting "Set-Cookie: Max-Age=2; person=daniel" to be a cookie named 'person' while an RFC 6265 compliant parser should consider that to be a cookie named 'Max-Age' with an (unknown) parameter 'person'. Fixes #709
2016-03-10 05:20:56 -05:00
Set-Cookie: bug=fixed; domain=.example.fake;
test1218: another cookie tailmatch test ... and make 1216 also verify it with a file input These tests verify commit 3604fde3d3c9b0d, the fix for the "cookie domain tailmatch" vulnerability. See http://curl.haxx.se/docs/adv_20130412.html
2013-04-10 07:40:36 -04:00
Content-Length: 21
test1218: adjusted for hyper mode Closes #7209
2021-06-08 17:58:30 -04:00
test1218: another cookie tailmatch test ... and make 1216 also verify it with a file input These tests verify commit 3604fde3d3c9b0d, the fix for the "cookie domain tailmatch" vulnerability. See http://curl.haxx.se/docs/adv_20130412.html
2013-04-10 07:40:36 -04:00
This server says moo
</data>
</reply>
# Client-side
<client>
<server>
http
</server>
<name>
HTTP cookies and domains with same prefix
</name>
<command>
tests: use %TESTNUMBER instead of fixed number This makes the tests easier to copy and relocate to other test numbers without having to update content. Closes #6738
2021-03-12 11:38:26 -05:00
http://example.fake/c/%TESTNUMBER http://example.fake/c/%TESTNUMBER http://bexample.fake/c/%TESTNUMBER -b nonexisting -x %HOSTIP:%HTTPPORT
test1218: another cookie tailmatch test ... and make 1216 also verify it with a file input These tests verify commit 3604fde3d3c9b0d, the fix for the "cookie domain tailmatch" vulnerability. See http://curl.haxx.se/docs/adv_20130412.html
2013-04-10 07:40:36 -04:00
</command>
tests: use proxy feature This makes the tests succeed when using --disable-proxy. Closes https://github.com/curl/curl/pull/4488
2019-10-14 16:29:19 -04:00
<features>
proxy
</features>
test1218: another cookie tailmatch test ... and make 1216 also verify it with a file input These tests verify commit 3604fde3d3c9b0d, the fix for the "cookie domain tailmatch" vulnerability. See http://curl.haxx.se/docs/adv_20130412.html
2013-04-10 07:40:36 -04:00
</client>
# Verify data after the test has been "shot"
<verify>
<protocol>
tests: use %TESTNUMBER instead of fixed number This makes the tests easier to copy and relocate to other test numbers without having to update content. Closes #6738
2021-03-12 11:38:26 -05:00
GET http://example.fake/c/%TESTNUMBER HTTP/1.1
test1218: another cookie tailmatch test ... and make 1216 also verify it with a file input These tests verify commit 3604fde3d3c9b0d, the fix for the "cookie domain tailmatch" vulnerability. See http://curl.haxx.se/docs/adv_20130412.html
2013-04-10 07:40:36 -04:00
Host: example.fake
runtests: provide curl's version string as %VERSION for tests ... so that we can check HTTP requests for User-Agent: curl/%VERSION Update 600+ test cases accordingly. Closes #6037
2020-10-02 07:45:24 -04:00
User-Agent: curl/%VERSION
test1218: another cookie tailmatch test ... and make 1216 also verify it with a file input These tests verify commit 3604fde3d3c9b0d, the fix for the "cookie domain tailmatch" vulnerability. See http://curl.haxx.se/docs/adv_20130412.html
2013-04-10 07:40:36 -04:00
Accept: */*
Revert "Proxy-Connection: stop sending this header by default" This reverts commit 113f04e664b16b944e64498a73a4dab990fe9a68.
2016-08-16 02:36:04 -04:00
Proxy-Connection: Keep-Alive
test1218: another cookie tailmatch test ... and make 1216 also verify it with a file input These tests verify commit 3604fde3d3c9b0d, the fix for the "cookie domain tailmatch" vulnerability. See http://curl.haxx.se/docs/adv_20130412.html
2013-04-10 07:40:36 -04:00
tests: use %TESTNUMBER instead of fixed number This makes the tests easier to copy and relocate to other test numbers without having to update content. Closes #6738
2021-03-12 11:38:26 -05:00
GET http://example.fake/c/%TESTNUMBER HTTP/1.1
test1218: another cookie tailmatch test ... and make 1216 also verify it with a file input These tests verify commit 3604fde3d3c9b0d, the fix for the "cookie domain tailmatch" vulnerability. See http://curl.haxx.se/docs/adv_20130412.html
2013-04-10 07:40:36 -04:00
Host: example.fake
runtests: provide curl's version string as %VERSION for tests ... so that we can check HTTP requests for User-Agent: curl/%VERSION Update 600+ test cases accordingly. Closes #6037
2020-10-02 07:45:24 -04:00
User-Agent: curl/%VERSION
test1218: another cookie tailmatch test ... and make 1216 also verify it with a file input These tests verify commit 3604fde3d3c9b0d, the fix for the "cookie domain tailmatch" vulnerability. See http://curl.haxx.se/docs/adv_20130412.html
2013-04-10 07:40:36 -04:00
Accept: */*
Revert "Proxy-Connection: stop sending this header by default" This reverts commit 113f04e664b16b944e64498a73a4dab990fe9a68.
2016-08-16 02:36:04 -04:00
Proxy-Connection: Keep-Alive
test1218: another cookie tailmatch test ... and make 1216 also verify it with a file input These tests verify commit 3604fde3d3c9b0d, the fix for the "cookie domain tailmatch" vulnerability. See http://curl.haxx.se/docs/adv_20130412.html
2013-04-10 07:40:36 -04:00
Cookie: bug=fixed
tests: use %TESTNUMBER instead of fixed number This makes the tests easier to copy and relocate to other test numbers without having to update content. Closes #6738
2021-03-12 11:38:26 -05:00
GET http://bexample.fake/c/%TESTNUMBER HTTP/1.1
test1218: another cookie tailmatch test ... and make 1216 also verify it with a file input These tests verify commit 3604fde3d3c9b0d, the fix for the "cookie domain tailmatch" vulnerability. See http://curl.haxx.se/docs/adv_20130412.html
2013-04-10 07:40:36 -04:00
Host: bexample.fake
runtests: provide curl's version string as %VERSION for tests ... so that we can check HTTP requests for User-Agent: curl/%VERSION Update 600+ test cases accordingly. Closes #6037
2020-10-02 07:45:24 -04:00
User-Agent: curl/%VERSION
test1218: another cookie tailmatch test ... and make 1216 also verify it with a file input These tests verify commit 3604fde3d3c9b0d, the fix for the "cookie domain tailmatch" vulnerability. See http://curl.haxx.se/docs/adv_20130412.html
2013-04-10 07:40:36 -04:00
Accept: */*
Revert "Proxy-Connection: stop sending this header by default" This reverts commit 113f04e664b16b944e64498a73a4dab990fe9a68.
2016-08-16 02:36:04 -04:00
Proxy-Connection: Keep-Alive
test1218: another cookie tailmatch test ... and make 1216 also verify it with a file input These tests verify commit 3604fde3d3c9b0d, the fix for the "cookie domain tailmatch" vulnerability. See http://curl.haxx.se/docs/adv_20130412.html
2013-04-10 07:40:36 -04:00
</protocol>
</verify>
</testcase>
Reference in New Issue Copy Permalink