You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
95 lines
3.7 KiB
95 lines
3.7 KiB
From 69a2e8d7ec581695a62527cb2252e7350f314ffa Mon Sep 17 00:00:00 2001
|
|
From: Daniel Stenberg <daniel@haxx.se>
|
|
Date: Thu, 23 Apr 2015 15:58:21 +0200
|
|
Subject: [PATCH] CURLOPT_HEADEROPT: default to separate
|
|
|
|
Make the HTTP headers separated by default for improved security and
|
|
reduced risk for information leakage.
|
|
|
|
Bug: http://curl.haxx.se/docs/adv_20150429.html
|
|
Reported-by: Yehezkel Horowitz, Oren Souroujon
|
|
---
|
|
docs/libcurl/opts/CURLOPT_HEADEROPT.3 | 12 ++++++------
|
|
lib/url.c | 1 +
|
|
tests/data/test1527 | 2 +-
|
|
tests/data/test287 | 2 +-
|
|
tests/libtest/lib1527.c | 1 +
|
|
5 files changed, 10 insertions(+), 8 deletions(-)
|
|
|
|
--- a/docs/libcurl/opts/CURLOPT_HEADEROPT.3
|
|
+++ b/docs/libcurl/opts/CURLOPT_HEADEROPT.3
|
|
@@ -5,7 +5,7 @@
|
|
.\" * | (__| |_| | _ <| |___
|
|
.\" * \___|\___/|_| \_\_____|
|
|
.\" *
|
|
-.\" * Copyright (C) 1998 - 2014, Daniel Stenberg, <daniel@haxx.se>, et al.
|
|
+.\" * Copyright (C) 1998 - 2015, Daniel Stenberg, <daniel@haxx.se>, et al.
|
|
.\" *
|
|
.\" * This software is licensed as described in the file COPYING, which
|
|
.\" * you should have received as part of this distribution. The terms
|
|
@@ -31,10 +31,10 @@ CURLcode curl_easy_setopt(CURL *handle,
|
|
Pass a long that is a bitmask of options of how to deal with headers. The two
|
|
mutually exclusive options are:
|
|
|
|
-\fBCURLHEADER_UNIFIED\fP - keep working as before. This means
|
|
-\fICURLOPT_HTTPHEADER(3)\fP headers will be used in requests both to servers
|
|
-and proxies. With this option enabled, \fICURLOPT_PROXYHEADER(3)\fP will not
|
|
-have any effect.
|
|
+\fBCURLHEADER_UNIFIED\fP - the headers specified in
|
|
+\fICURLOPT_HTTPHEADER(3)\fP will be used in requests both to servers and
|
|
+proxies. With this option enabled, \fICURLOPT_PROXYHEADER(3)\fP will not have
|
|
+any effect.
|
|
|
|
\fBCURLHEADER_SEPARATE\fP - makes \fICURLOPT_HTTPHEADER(3)\fP headers only get
|
|
sent to a server and not to a proxy. Proxy headers must be set with
|
|
@@ -44,7 +44,7 @@ headers. When doing CONNECT, libcurl wil
|
|
headers only to the proxy and then \fICURLOPT_HTTPHEADER(3)\fP headers only to
|
|
the server.
|
|
.SH DEFAULT
|
|
-CURLHEADER_UNIFIED
|
|
+CURLHEADER_SEPARATE (changed in 7.42.1, ased CURLHEADER_UNIFIED before then)
|
|
.SH PROTOCOLS
|
|
HTTP
|
|
.SH EXAMPLE
|
|
--- a/lib/url.c
|
|
+++ b/lib/url.c
|
|
@@ -605,6 +605,7 @@ CURLcode Curl_init_userdefined(struct Us
|
|
set->ssl_enable_alpn = TRUE;
|
|
|
|
set->expect_100_timeout = 1000L; /* Wait for a second by default. */
|
|
+ set->sep_headers = TRUE; /* separated header lists by default */
|
|
return result;
|
|
}
|
|
|
|
--- a/tests/data/test1527
|
|
+++ b/tests/data/test1527
|
|
@@ -45,7 +45,7 @@ http-proxy
|
|
lib1527
|
|
</tool>
|
|
<name>
|
|
-Check same headers are generated without CURLOPT_PROXYHEADER
|
|
+Check same headers are generated with CURLOPT_HEADEROPT == CURLHEADER_UNIFIED
|
|
</name>
|
|
<command>
|
|
http://the.old.moo.1527:%HTTPPORT/1527 %HOSTIP:%PROXYPORT
|
|
--- a/tests/data/test287
|
|
+++ b/tests/data/test287
|
|
@@ -28,7 +28,7 @@ http
|
|
HTTP proxy CONNECT with custom User-Agent header
|
|
</name>
|
|
<command>
|
|
-http://test.remote.example.com.287:%HTTPPORT/path/287 -H "User-Agent: looser/2007" --proxy http://%HOSTIP:%HTTPPORT --proxytunnel
|
|
+http://test.remote.example.com.287:%HTTPPORT/path/287 -H "User-Agent: looser/2015" --proxy http://%HOSTIP:%HTTPPORT --proxytunnel --proxy-header "User-Agent: looser/2007"
|
|
</command>
|
|
</client>
|
|
|
|
--- a/tests/libtest/lib1527.c
|
|
+++ b/tests/libtest/lib1527.c
|
|
@@ -83,6 +83,7 @@ int test(char *URL)
|
|
test_setopt(curl, CURLOPT_READFUNCTION, read_callback);
|
|
test_setopt(curl, CURLOPT_HTTPPROXYTUNNEL, 1L);
|
|
test_setopt(curl, CURLOPT_INFILESIZE, strlen(data));
|
|
+ test_setopt(curl, CURLOPT_HEADEROPT, CURLHEADER_UNIFIED);
|
|
|
|
res = curl_easy_perform(curl);
|
|
|