moparisthebest/curl
1
0
Fork 0
mirror of https://github.com/moparisthebest/curl synced 2024-12-22 08:08:50 -05:00
Code Issues Releases Wiki Activity
d7c103746c
curl/tests/data/test1218

62 lines
1.1 KiB
Plaintext
Raw Normal View History

test1218: another cookie tailmatch test ... and make 1216 also verify it with a file input These tests verify commit 3604fde3d3c9b0d, the fix for the "cookie domain tailmatch" vulnerability. See http://curl.haxx.se/docs/adv_20130412.html
2013-04-10 07:40:36 -04:00
<testcase>
<info>
<keywords>
HTTP
HTTP GET
HTTP proxy
cookies
</keywords>
</info>
# This test is very similar to 1216, only that it sets the cookies from the
# first site instead of reading from a file
<reply>
<data>
HTTP/1.1 200 OK
Date: Tue, 25 Sep 2001 19:37:44 GMT
cookies: first n/v pair in Set-Cookie: is the cookie, then parameters RFC 6265 section 4.1.1 spells out that the first name/value pair in the header is the actual cookie name and content, while the following are the parameters. libcurl previously had a more liberal approach which causes significant problems when introducing new cookie parameters, like the suggested new cookie priority draft. The previous logic read all n/v pairs from left-to-right and the first name used that wassn't a known parameter name would be used as the cookie name, thus accepting "Set-Cookie: Max-Age=2; person=daniel" to be a cookie named 'person' while an RFC 6265 compliant parser should consider that to be a cookie named 'Max-Age' with an (unknown) parameter 'person'. Fixes #709
2016-03-10 05:20:56 -05:00
Set-Cookie: bug=fixed; domain=.example.fake;
test1218: another cookie tailmatch test ... and make 1216 also verify it with a file input These tests verify commit 3604fde3d3c9b0d, the fix for the "cookie domain tailmatch" vulnerability. See http://curl.haxx.se/docs/adv_20130412.html
2013-04-10 07:40:36 -04:00
Content-Length: 21
This server says moo
</data>
</reply>
# Client-side
<client>
<server>
http
</server>
<name>
HTTP cookies and domains with same prefix
</name>
<command>
http://example.fake/c/1218 http://example.fake/c/1218 http://bexample.fake/c/1218 -b nonexisting -x %HOSTIP:%HTTPPORT
</command>
</client>
# Verify data after the test has been "shot"
<verify>
<strip>
^User-Agent:.*
</strip>
<protocol>
GET http://example.fake/c/1218 HTTP/1.1
Host: example.fake
Accept: */*
Revert "Proxy-Connection: stop sending this header by default" This reverts commit 113f04e664b16b944e64498a73a4dab990fe9a68.
2016-08-16 02:36:04 -04:00
Proxy-Connection: Keep-Alive
test1218: another cookie tailmatch test ... and make 1216 also verify it with a file input These tests verify commit 3604fde3d3c9b0d, the fix for the "cookie domain tailmatch" vulnerability. See http://curl.haxx.se/docs/adv_20130412.html
2013-04-10 07:40:36 -04:00
GET http://example.fake/c/1218 HTTP/1.1
Host: example.fake
Accept: */*
Revert "Proxy-Connection: stop sending this header by default" This reverts commit 113f04e664b16b944e64498a73a4dab990fe9a68.
2016-08-16 02:36:04 -04:00
Proxy-Connection: Keep-Alive
test1218: another cookie tailmatch test ... and make 1216 also verify it with a file input These tests verify commit 3604fde3d3c9b0d, the fix for the "cookie domain tailmatch" vulnerability. See http://curl.haxx.se/docs/adv_20130412.html
2013-04-10 07:40:36 -04:00
Cookie: bug=fixed
GET http://bexample.fake/c/1218 HTTP/1.1
Host: bexample.fake
Accept: */*
Revert "Proxy-Connection: stop sending this header by default" This reverts commit 113f04e664b16b944e64498a73a4dab990fe9a68.
2016-08-16 02:36:04 -04:00
Proxy-Connection: Keep-Alive
test1218: another cookie tailmatch test ... and make 1216 also verify it with a file input These tests verify commit 3604fde3d3c9b0d, the fix for the "cookie domain tailmatch" vulnerability. See http://curl.haxx.se/docs/adv_20130412.html
2013-04-10 07:40:36 -04:00
</protocol>
</verify>
</testcase>
Reference in New Issue Copy Permalink