diff options
author | Daniel Stenberg <daniel@haxx.se> | 2018-01-19 13:19:25 +0100 |
---|---|---|
committer | Daniel Stenberg <daniel@haxx.se> | 2018-01-22 10:00:00 +0100 |
commit | af32cd3859336ab963591ca0df9b1e33a7ee066b (patch) | |
tree | ae91ca52a3cbbfabe89c74dda181abbbc40c1150 /lib/http.c | |
parent | 993dd5651a6c853bfe3870f6a69c7b329fa4e8ce (diff) |
http: prevent custom Authorization headers in redirects
... unless CURLOPT_UNRESTRICTED_AUTH is set to allow them. This matches how
curl already handles Authorization headers created internally.
Note: this changes behavior slightly, for the sake of reducing mistakes.
Added test 317 and 318 to verify.
Reported-by: Craig de Stigter
Bug: https://curl.haxx.se/docs/adv_2018-b3bf.html
Diffstat (limited to 'lib/http.c')
-rw-r--r-- | lib/http.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/lib/http.c b/lib/http.c index c1cdf2da0..a5007670d 100644 --- a/lib/http.c +++ b/lib/http.c @@ -714,7 +714,7 @@ Curl_http_output_auth(struct connectdata *conn, if(!data->state.this_is_a_follow || conn->bits.netrc || !data->state.first_host || - data->set.http_disable_hostname_check_before_authentication || + data->set.allow_auth_to_other_hosts || strcasecompare(data->state.first_host, conn->host.name)) { result = output_auth_headers(conn, authhost, request, path, FALSE); } @@ -1636,6 +1636,14 @@ CURLcode Curl_add_custom_headers(struct connectdata *conn, checkprefix("Transfer-Encoding:", headers->data)) /* HTTP/2 doesn't support chunked requests */ ; + else if(checkprefix("Authorization:", headers->data) && + /* be careful of sending this potentially sensitive header to + other hosts */ + (data->state.this_is_a_follow && + data->state.first_host && + !data->set.allow_auth_to_other_hosts && + !strcasecompare(data->state.first_host, conn->host.name))) + ; else { CURLcode result = Curl_add_bufferf(req_buffer, "%s\r\n", headers->data); |