moparisthebest/curl
1
0
Fork 0
mirror of https://github.com/moparisthebest/curl synced 2025-02-28 09:21:50 -05:00
Code Issues Releases Wiki Activity

cookies: extend domain checks to non psl builds

Browse Source 
Ensure to perform the checks we have to enforce a sane domain in
the cookie request. The check for non-PSL enabled builds is quite
basic but it's better than nothing.

Closes #2964
Reviewed-by: Daniel Stenberg <daniel@haxx.se>
This commit is contained in:
Daniel Gustafsson 2018-12-19 20:59:09 +01:00
parent 462037ad48
commit 3773de378d
2 changed files with 9 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
lib/cookie.c
View File

@ -803,6 +803,8 @@ Curl_cookie_add(struct Curl_easy *data,
co->domain = strdup(ptr);
if(!co->domain)
badcookie = TRUE;
else if(bad_domain(co->domain))
badcookie = TRUE;
break;
case 1:
/* This field got its explanation on the 23rd of May 2001 by
@ -906,18 +908,20 @@ Curl_cookie_add(struct Curl_easy *data,
if(!noexpire)
remove_expired(c);
#ifdef USE_LIBPSL
/* Check if the domain is a Public Suffix and if yes, ignore the cookie. */
if(domain && co->domain && !isip(co->domain)) {
const psl_ctx_t *psl = Curl_psl_use(data);
int acceptable;
#ifdef USE_LIBPSL
const psl_ctx_t *psl = Curl_psl_use(data);
/* Check if the domain is a Public Suffix and if yes, ignore the cookie. */
if(psl) {
acceptable = psl_is_cookie_domain_acceptable(psl, domain, co->domain);
Curl_psl_release(data);
}
else
acceptable = !bad_domain(domain);
#endif
/* Without libpsl, do the best we can. */
acceptable = !bad_domain(co->domain);
if(!acceptable) {
infof(data, "cookie '%s' dropped, domain '%s' must not "
@ -926,7 +930,6 @@ Curl_cookie_add(struct Curl_easy *data,
return NULL;
}
}
#endif
myhash = cookiehash(co->domain);
clist = c->cookies[myhash];

1
tests/data/test8
View File

@ -46,6 +46,7 @@ Set-Cookie: trailingspace = removed; path=/we/want;
Set-Cookie: nocookie=yes; path=/WE;
Set-Cookie: blexp=yesyes; domain=%HOSTIP; domain=%HOSTIP; expiry=totally bad;
Set-Cookie: partialip=nono; domain=.0.0.1;
Set-Cookie: chocolate=chip; domain=curl; path=/we/want;
</file>
<precheck>