From af32cd3859336ab963591ca0df9b1e33a7ee066b Mon Sep 17 00:00:00 2001 From: Daniel Stenberg Date: Fri, 19 Jan 2018 13:19:25 +0100 Subject: http: prevent custom Authorization headers in redirects ... unless CURLOPT_UNRESTRICTED_AUTH is set to allow them. This matches how curl already handles Authorization headers created internally. Note: this changes behavior slightly, for the sake of reducing mistakes. Added test 317 and 318 to verify. Reported-by: Craig de Stigter Bug: https://curl.haxx.se/docs/adv_2018-b3bf.html --- tests/data/Makefile.inc | 2 +- tests/data/test317 | 94 ++++++++++++++++++++++++++++++++++++++++++++++++ tests/data/test318 | 95 +++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 190 insertions(+), 1 deletion(-) create mode 100644 tests/data/test317 create mode 100644 tests/data/test318 (limited to 'tests') diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc index 7e3ca25d5..a2cf70bcd 100644 --- a/tests/data/Makefile.inc +++ b/tests/data/Makefile.inc @@ -55,7 +55,7 @@ test280 test281 test282 test283 test284 test285 test286 test287 test288 \ test289 test290 test291 test292 test293 test294 test295 test296 test297 \ test298 test299 test300 test301 test302 test303 test304 test305 test306 \ test307 test308 test309 test310 test311 test312 test313 test314 test315 \ -test316 test320 test321 test322 test323 test324 \ +test316 test317 test318 test320 test321 test322 test323 test324 \ test325 \ test350 test351 test352 test353 test354 \ test393 test394 test395 \ diff --git a/tests/data/test317 b/tests/data/test317 new file mode 100644 index 000000000..c6d8697be --- /dev/null +++ b/tests/data/test317 @@ -0,0 +1,94 @@ + + + +HTTP +HTTP proxy +HTTP Basic auth +HTTP proxy Basic auth +followlocation + + +# +# Server-side + + +HTTP/1.1 302 OK +Date: Thu, 09 Nov 2010 14:49:00 GMT +Server: test-server/fake swsclose +Content-Type: text/html +Funny-head: yesyes +Location: http://goto.second.host.now/3170002 +Content-Length: 8 +Connection: close + +contents + + +HTTP/1.1 200 OK +Date: Thu, 09 Nov 2010 14:49:00 GMT +Server: test-server/fake swsclose +Content-Type: text/html +Funny-head: yesyes +Content-Length: 9 + +contents + + + +HTTP/1.1 302 OK +Date: Thu, 09 Nov 2010 14:49:00 GMT +Server: test-server/fake swsclose +Content-Type: text/html +Funny-head: yesyes +Location: http://goto.second.host.now/3170002 +Content-Length: 8 +Connection: close + +HTTP/1.1 200 OK +Date: Thu, 09 Nov 2010 14:49:00 GMT +Server: test-server/fake swsclose +Content-Type: text/html +Funny-head: yesyes +Content-Length: 9 + +contents + + + +# +# Client-side + + +http + + +HTTP with custom Authorization: and redirect to new host + + +http://first.host.it.is/we/want/that/page/317 -x %HOSTIP:%HTTPPORT -H "Authorization: s3cr3t" --proxy-user testing:this --location + + + +# +# Verify data after the test has been "shot" + + +^User-Agent:.* + + +GET http://first.host.it.is/we/want/that/page/317 HTTP/1.1 +Host: first.host.it.is +Proxy-Authorization: Basic dGVzdGluZzp0aGlz +Accept: */* +Proxy-Connection: Keep-Alive +Authorization: s3cr3t + +GET http://goto.second.host.now/3170002 HTTP/1.1 +Host: goto.second.host.now +Proxy-Authorization: Basic dGVzdGluZzp0aGlz +Accept: */* +Proxy-Connection: Keep-Alive + + + + diff --git a/tests/data/test318 b/tests/data/test318 new file mode 100644 index 000000000..838d1ba0f --- /dev/null +++ b/tests/data/test318 @@ -0,0 +1,95 @@ + + + +HTTP +HTTP proxy +HTTP Basic auth +HTTP proxy Basic auth +followlocation + + +# +# Server-side + + +HTTP/1.1 302 OK +Date: Thu, 09 Nov 2010 14:49:00 GMT +Server: test-server/fake swsclose +Content-Type: text/html +Funny-head: yesyes +Location: http://goto.second.host.now/3180002 +Content-Length: 8 +Connection: close + +contents + + +HTTP/1.1 200 OK +Date: Thu, 09 Nov 2010 14:49:00 GMT +Server: test-server/fake swsclose +Content-Type: text/html +Funny-head: yesyes +Content-Length: 9 + +contents + + + +HTTP/1.1 302 OK +Date: Thu, 09 Nov 2010 14:49:00 GMT +Server: test-server/fake swsclose +Content-Type: text/html +Funny-head: yesyes +Location: http://goto.second.host.now/3180002 +Content-Length: 8 +Connection: close + +HTTP/1.1 200 OK +Date: Thu, 09 Nov 2010 14:49:00 GMT +Server: test-server/fake swsclose +Content-Type: text/html +Funny-head: yesyes +Content-Length: 9 + +contents + + + +# +# Client-side + + +http + + +HTTP with custom Authorization: and redirect to new host + + +http://first.host.it.is/we/want/that/page/318 -x %HOSTIP:%HTTPPORT -H "Authorization: s3cr3t" --proxy-user testing:this --location-trusted + + + +# +# Verify data after the test has been "shot" + + +^User-Agent:.* + + +GET http://first.host.it.is/we/want/that/page/318 HTTP/1.1 +Host: first.host.it.is +Proxy-Authorization: Basic dGVzdGluZzp0aGlz +Accept: */* +Proxy-Connection: Keep-Alive +Authorization: s3cr3t + +GET http://goto.second.host.now/3180002 HTTP/1.1 +Host: goto.second.host.now +Proxy-Authorization: Basic dGVzdGluZzp0aGlz +Accept: */* +Proxy-Connection: Keep-Alive +Authorization: s3cr3t + + + + -- cgit v1.2.3