From 18f044f19d26f2b6dcd41796966f488a62a1bdca Mon Sep 17 00:00:00 2001 From: Daniel Stenberg Date: Wed, 11 Apr 2001 14:13:52 +0000 Subject: [PATCH] we don't use the HTTP_PROXY environment variable in uppercase anymore, since it might become a security problem (Bugs item #415391) --- lib/url.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/lib/url.c b/lib/url.c index 0a01e54d2..8880c1eb2 100644 --- a/lib/url.c +++ b/lib/url.c @@ -1579,7 +1579,19 @@ static CURLcode Connect(struct UrlData *data, /* read the protocol proxy: */ prox=curl_getenv(proxy_env); - if(!prox) { + /* + * We don't try the uppercase version of HTTP_PROXY because of + * security reasons: + * + * When curl is used in a webserver application + * environment (cgi or php), this environment variable can + * be controlled by the web server user by setting the + * http header 'Proxy:' to some value. + * + * This can cause 'internal' http/ftp requests to be + * arbitrarily redirected by any external attacker. + */ + if(!prox && !strequal("http_proxy", proxy_env)) { /* There was no lowercase variable, try the uppercase version: */ for(envp = proxy_env; *envp; envp++) *envp = toupper(*envp);