Commit Graph

441 Commits

Author SHA1 Message Date
Daniel Stenberg
0ad7c8d7d5
digest: pass over leading spaces in qop values
When parsing the "qop=" parameter of the digest authentication, and the
value is provided within quotes, the list of values can have leading
white space which the parser previously did not handle correctly.

Add test case 388 to verify.

Reported-by: vlubart on github
Fixes #9264
Closes #9270
2022-08-08 08:28:04 +02:00
Daniel Stenberg
e6f8445ede
setopt: add CURLOPT_PROTOCOLS_STR and CURLOPT_REDIR_PROTOCOLS_STR
... as replacements for deprecated CURLOPT_PROTOCOLS and
CURLOPT_REDIR_PROTOCOLS as these new ones do not risk running into the
32 bit limit the old ones are facing.

CURLINFO_PROTCOOL is now deprecated.

The curl tool is updated to use the new options.

Added test 1597 to verify the libcurl protocol parser.

Closes #8992
2022-07-04 08:35:09 +02:00
Daniel Stenberg
46f8911d39
test444: test many received Set-Cookie:
The amount of sent cookies in the test is limited to 80 because hyper
has its own strict limits in how many headers it allows to be received
which triggers at some point beyond this number.
2022-06-26 11:01:56 +02:00
Daniel Stenberg
ff2b2bcf68
test442/443: test cookie caps
442 - verify that only 150 cookies are sent
443 - verify that the cookie: header remains less than 8K in size
2022-06-26 11:01:01 +02:00
Daniel Stenberg
7230b19a2e
test387: verify rejection of compression chain attack 2022-06-25 22:14:32 +02:00
max.mehl
ad9bc5976d
copyright: make repository REUSE compliant
Add licensing and copyright information for all files in this repository. This
either happens in the file itself as a comment header or in the file
`.reuse/dep5`.

This commit also adds a Github workflow to check pull requests and adapts
copyright.pl to the changes.

Closes #8869
2022-06-13 09:13:00 +02:00
Daniel Stenberg
95f5aae9ad
test390: verify --parallel
Closes #8985
2022-06-10 09:05:25 +02:00
Daniel Stenberg
5121d98c22
test1543: verify CURLINFO_EFFECTIVE_URL with CURLOPT_CURLU set
Triggered by a bug report from Adam Light:
https://curl.se/mail/lib-2022-06/0013.html - which ended up being mostly
a misunderstanding of how CURLINFO_EFFECTIVE_URL works.

Closes #8971
2022-06-08 16:32:46 +02:00
Daniel Stenberg
5394cbf570
test391: verify --path-as-is with redirect 2022-06-08 10:30:28 +02:00
Thomas Guillem
2ed1012564
curl_version_info: add CURL_VERSION_THREADSAFE_INIT
This flag can be used to make sure that curl_global_init() is
thread-safe.

This can be useful for libraries that can't control what other
dependencies are doing with Curl.

Closes #8680
2022-06-07 13:34:03 +02:00
Daniel Stenberg
ef94c972bc
test681: verify --no-remote-name
Follow-up to 83ee5c428d (from #8931)

Closes #8942
2022-05-31 16:09:53 +02:00
Daniel Stenberg
d1b376c035
test680: verify rejection of malformatted .netrc quoted password 2022-05-31 09:05:01 +02:00
Daniel Stenberg
19f981b4ff
test679: verify netrc quoted string 2022-05-31 09:05:01 +02:00
Daniel Stenberg
c9b60f0053
http: restore header folding behavior
Folded header lines will now get passed through like before. The headers
API is adapted and will provide the content unfolded.

Added test 1274 and extended test 1940 to verify.

Reported-by: Petr Pisar
Fixes #8844
Closes #8899
2022-05-24 23:33:47 +02:00
Balakrishnan Balasubramanian
dfa84a0450
socks: support unix sockets for socks proxy
Usage:
  curl -x "socks5h://localhost/run/tor/socks" "https://example.com"

Updated runtests.pl to run a socksd server listening on unix socket

Added tests test1467 test1468

Added documentation for proxy command line option and socks proxy
options

Closes #8668
2022-05-19 15:35:03 +02:00
Daniel Stenberg
9ec22e4fe6
test414: verify secure cookie domain overlay 2022-05-19 14:48:26 +02:00
Daniel Stenberg
3ead914303
test1635: verify --fail-with-body with --retry
Almost a dupe of 1634

Closes #8847
2022-05-16 10:04:21 +02:00
Daniel Stenberg
5227367903
test1919: verify CURLOPT_XOAUTH2_BEARER leak fix 2022-05-14 18:05:20 +02:00
Daniel Stenberg
f8cb6c610a
test977: reproduce ability to set cookie on TLD
When PSL is not enabled
2022-05-09 16:47:28 +02:00
Daniel Stenberg
43cec1d4f8
test379: verify --remove-on-error with --no-clobber 2022-05-09 12:56:30 +02:00
Daniel Stenberg
ff3ee510c3
test440/441: verify HSTS with trailing dots 2022-05-09 12:54:39 +02:00
Daniel Stenberg
46d45ea3af
test412/413: verify alt-svc with trailing dots 2022-05-09 09:39:22 +02:00
Daniel Stenberg
5295e8d64a
tests: verify the fix for CVE-2022-27774
- Test 973 redirects from HTTP to FTP, clear auth
 - Test 974 redirects from HTTP to HTTP different port, clear auth
 - Test 975 redirects from HTTP to FTP, permitted to keep auth
 - Test 976 redirects from HTTP to HTTP different port, permitted to keep
   auth
2022-04-25 16:24:33 +02:00
Daniel Stenberg
afe752e050
test898: verify the fix for CVE-2022-27776
Do not pass on Authorization headers on redirects to another port
2022-04-25 13:05:47 +02:00
Daniel Stenberg
a09a12806e
tool_getparam: error out on missing -K file
Add test 411 to verify.

Reported-by: Median Median Stride
Bug: https://hackerone.com/reports/1542881
Closes #8731
2022-04-25 11:38:50 +02:00
Daniel Stenberg
01a1697a79
curl: error out if -T and -d are used for the same URL
As one implies PUT and the other POST, both cannot be used
simultaneously.

Add test 378 to verify.

Reported-by: Boris Verkhovskiy
Fixes #8704
Closes #8715
2022-04-17 11:18:17 +02:00
Daniel Stenberg
160b640a8b
test1671: verify -w '%{header_json} 2022-03-22 08:24:25 +01:00
Daniel Stenberg
62b60ed1a0
test1670: verify -w %header{} 2022-03-22 08:24:25 +01:00
Daniel Stenberg
d1e4a67734
header api: add curl_easy_header and curl_easy_nextheader
Add test 1940 to 1946 to verify.

Closes #8593
2022-03-22 08:24:22 +01:00
Daniel Stenberg
dcdf2e8a36
http: return error on colon-less HTTP headers
It's a protocol violation and accepting them leads to no good.

Add test case 398 to verify

Closes #8610
2022-03-21 08:37:24 +01:00
HexTheDragon
1831a6e7f1
curl: add --no-clobber
Does not overwrite output files if they already exist

Closes #7708
Co-authored-by: Daniel Stenberg
2022-03-11 08:38:01 +01:00
Daniel Stenberg
08a96c6e4e
curl: add --remove-on-error
If a transfer returns an error, using this option makes curl remove the
leftover downloded (partial) local file before exiting.

Added test 376 to verify

Closes #8503
2022-03-10 19:57:55 +01:00
Daniel Stenberg
3e842078f3
test375: verify that --proxy errors out if proxy is disabled in the build
Closes #8565
2022-03-10 08:31:07 +01:00
Daniel Stenberg
32160cae84
tool_getparam: initial --json support
Adds these test cases:

 383 - simple single command line option
 384 - reading it from stdin
 385 - getting two --json options on command line
 386 - --next works after --json

Closes #8314
2022-02-01 10:39:55 +01:00
Fabian Keil
e1e9d5af73
test374: gif data without new line at the end
Closes #8239
2022-01-10 15:54:54 +01:00
Daniel Stenberg
d1237ac906
url: given a user in the URL, find pwd for that user in netrc
Add test 380 and 381 to verify, edited test 133

Reported-by: Manfred Schwarb
Fixes #8241
Closes #8243
2022-01-09 14:16:41 +01:00
Daniel Stenberg
764e4f066d
tool_findfile: check ~/.config/curlrc too
... after the initial checks for .curlrc and if XDG_CONFIG_HOME is not
set, use $HOME and $CURL_HOME to check if ~/.config/curlrc is present.

Add test 436 to verify

Reported-by: Sandro Jaeckel
Fixes #8208
Closes #8213
2022-01-07 10:10:49 +01:00
Fabian Keil
5da22337fe
Add test373: multiple chunks with binary zeros 2022-01-07 10:01:44 +01:00
Fabian Keil
33d0503103
Add test372: binary zero in data element 2022-01-07 10:01:44 +01:00
Daniel Stenberg
dbbf3609f3
test719-721: verify SOCKS details
Using the new verify/socks details
2022-01-03 22:32:05 +01:00
Daniel Stenberg
effd2bd7ba
socks5: use appropriate ATYP for numerical IP address host names
When not resolving the address locallly (known as socks5h).

Add test 719 and 720 to verify.

Reported-by: Peter Piekarski
Fixes #8216
Closes #8217
2022-01-03 22:32:05 +01:00
Daniel Stenberg
ee2ca5826b
tool_operate: warn if too many output arguments were found
More output instructions than URLs is likely a user error.

Add test case 371 to verify

Closes #8210
2022-01-03 15:55:38 +01:00
Vladimir Panteleev
2c1dbc1af0
tests: Add test for CURLOPT_HTTP200ALIASES 2021-12-21 08:45:06 +01:00
Daniel Stenberg
2b3dd01b77
multi: handle errors returned from socket/timer callbacks
The callbacks were partially documented to support this. Now the
behavior is documented and returning error from either of these
callbacks will effectively kill all currently ongoing transfers.

Added test 530 to verify

Reported-by: Marcelo Juchem
Fixes #8083
Closes #8089
2021-12-06 14:55:52 +01:00
Patrick Monnerat
b20b364764
mime: use percent-escaping for multipart form field and file names
Until now, form field and file names where escaped using the
backslash-escaping algorithm defined for multipart mails. This commit
replaces this with the percent-escaping method for URLs.

As this may introduce incompatibilities with server-side applications, a
new libcurl option CURLOPT_MIME_OPTIONS with bitmask
CURLMIMEOPT_FORMESCAPE is introduced to revert to legacy use of
backslash-escaping. This is controlled by new cli tool option
--form-escape.

New tests and documentation are provided for this feature.

Reported by: Ryan Sleevi
Fixes #7789
Closes #7805
2021-11-15 10:40:03 +01:00
Daniel Stenberg
f0b7099a10
multi: shut down CONNECT in Curl_detach_connnection
... to prevent a lingering pointer that would lead to a double-free.

Added test 1939 to verify.

Reported-by: Stephen M. Coakley
Fixes #7982
Closes #7986
2021-11-11 08:42:31 +01:00
Marc Hoersken
b3e1ed3160
tests: add Schannel-specific tests and disable unsupported ones
Adds Schannel variants of SSLpinning tests that include the option
--ssl-revoke-best-effort to ignore certificate revocation check
failures which is required due to our custom test CA certificate.

Disable the original variants if the Schannel backend is enabled.

Also skip all IDN tests which are broken while using an msys shell.

This is a step to simplify test exclusions for Windows and MinGW.

Reviewed-by: Jay Satiro
Reviewed-by: Marcel Raad
Reviewed-by: Daniel Stenberg
Closes #7968
2021-11-09 06:34:33 +01:00
Daniel Stenberg
cc71d35265
tool_operate: a failed etag save now only fails that transfer
When failing to create the output file for saving an etag, only fail
that particular single transfer and allow others to follow.

In a serial transfer setup, if no transfer at all is done due to them
all being skipped because of this error, curl will output an error
message and return exit code 26.

Added test 369 and 370 to verify.

Reported-by: Earnestly on github
Ref: #7942
Closes #7945
2021-11-04 13:56:15 +01:00
Daniel Stenberg
c75f14cb9d
test1185: verify checksrc
Closes #7866
2021-10-18 23:52:30 +02:00
Abhinav Singh
8c6f126279
aws-sigv4: make signature work when post data is binary
User sets the post fields size for binary data.  Hence, we should not be
using strlen on it.

Added test 1937 and 1938 to verify.

Closes #7844
2021-10-15 08:46:23 +02:00