curl/lib
Daniel Stenberg aa5a28bd69
http2: verify :athority in push promise requests
RFC 7540 says we should verify that the push is for an "authoritative"
server. We make sure of this by only allowing push with an :athority
header that matches the host that was asked for in the URL.

Fixes #3577
Reported-by: Nicolas Grekas
Bug: https://curl.haxx.se/mail/lib-2019-02/0057.html
Closes #3581
2019-02-20 08:18:02 +01:00
..
vauth ntlm: fix *_type3_message size check to avoid buffer overflow 2019-02-04 08:22:32 +01:00
vtls mbedtls: release sessionid resources on error 2019-02-16 22:30:31 +01:00
.gitattributes
.gitignore
amigaos.c
amigaos.h whitespace fixes 2018-09-23 22:24:02 +00:00
arpa_telnet.h travis: add build for "configure --disable-verbose" 2018-10-18 14:51:49 +02:00
asyn-ares.c curl_multi_remove_handle() don't block terminating c-ares requests 2019-01-07 10:05:20 +01:00
asyn-thread.c curl_multi_remove_handle() don't block terminating c-ares requests 2019-01-07 10:05:20 +01:00
asyn.h curl_multi_remove_handle() don't block terminating c-ares requests 2019-01-07 10:05:20 +01:00
base64.c snprintf: renamed and we now only use msnprintf() 2018-11-23 08:26:51 +01:00
checksrc.pl checksrc: add COPYRIGHTYEAR check 2018-12-03 23:13:40 +01:00
CMakeLists.txt CMake: Improve config installation 2018-10-01 16:16:29 -04:00
config-amigaos.h
config-dos.h whitespace fixes 2018-09-23 22:24:02 +00:00
config-mac.h
config-os400.h
config-riscos.h
config-symbian.h
config-tpf.h
config-vxworks.h config: Remove unused SIZEOF_VOIDP 2018-10-24 11:20:57 +02:00
config-win32.h config_win32: enable LDAPS 2018-10-19 09:23:14 +02:00
config-win32ce.h
conncache.c cleanup: make local functions static 2019-02-10 18:38:57 +01:00
conncache.h conncache_unlock: avoid indirection by changing input argument type 2018-12-22 18:14:56 +01:00
connect.c cleanup: make local functions static 2019-02-10 18:38:57 +01:00
connect.h cleanup: make local functions static 2019-02-10 18:38:57 +01:00
content_encoding.c
content_encoding.h
cookie.c cookie: Add support for cookie prefixes 2019-02-17 00:09:30 +01:00
cookie.h cookie: Add support for cookie prefixes 2019-02-17 00:09:30 +01:00
curl_addrinfo.c
curl_addrinfo.h
curl_base64.h
curl_config.h.cmake config: Remove unused SIZEOF_VOIDP 2018-10-24 11:20:57 +02:00
curl_ctype.c
curl_ctype.h
curl_des.c
curl_des.h
curl_endian.c cleanup: make local functions static 2019-02-10 18:38:57 +01:00
curl_endian.h
curl_fnmatch.c fnmatch: disable if FTP is disabled 2019-02-12 07:50:39 +01:00
curl_fnmatch.h
curl_gethostname.c
curl_gethostname.h
curl_gssapi.c snprintf: renamed and we now only use msnprintf() 2018-11-23 08:26:51 +01:00
curl_gssapi.h gssapi: fix deprecated header warnings 2019-02-14 08:38:43 +01:00
curl_hmac.h
curl_ldap.h whitespace fixes 2018-09-23 22:24:02 +00:00
curl_md4.h
curl_md5.h
curl_memory.h
curl_memrchr.c
curl_memrchr.h
curl_multibyte.c curl_multibyte: fix a malloc overcalculation 2018-11-06 03:11:05 -05:00
curl_multibyte.h
curl_ntlm_core.c cleanup: make local functions static 2019-02-10 18:38:57 +01:00
curl_ntlm_core.h
curl_ntlm_wb.c curl_ntlm_wb: check aprintf() return codes 2018-10-08 12:06:33 +02:00
curl_ntlm_wb.h
curl_path.c curl_path: only enabled for SSH builds 2019-02-12 07:50:39 +01:00
curl_path.h headers: end all headers with guard comment 2018-10-23 10:02:24 +02:00
curl_printf.h snprintf: renamed and we now only use msnprintf() 2018-11-23 08:26:51 +01:00
curl_range.c
curl_range.h
curl_rtmp.c rtmp: fix for compiling with lwIP 2018-10-26 00:04:02 +02:00
curl_rtmp.h
curl_sasl.c urldata: rename easy_conn to just conn 2019-01-11 15:35:13 +01:00
curl_sasl.h
curl_sec.h
curl_setup_once.h whitespace fixes 2018-09-23 22:24:02 +00:00
curl_setup.h cleanup: make local functions static 2019-02-10 18:38:57 +01:00
curl_sha256.h
curl_sspi.c comment: Fix multiple typos in function parameters 2018-10-03 10:27:27 +02:00
curl_sspi.h
curl_threads.c curl_threads: fix classic MinGW compile break 2018-09-27 09:13:20 +02:00
curl_threads.h Windows: fixes for MinGW targeting Windows Vista 2018-10-09 08:33:45 +02:00
curlx.h snprintf: renamed and we now only use msnprintf() 2018-11-23 08:26:51 +01:00
dict.c url: use the URL API internally as well 2018-09-22 11:58:10 +02:00
dict.h
doh.c printf: fix format specifiers 2019-01-04 23:50:48 +01:00
doh.h headers: end all headers with guard comment 2018-10-23 10:02:24 +02:00
dotdot.c Curl_dedotdotify(): always nul terminate returned string. 2018-09-24 07:48:41 +02:00
dotdot.h headers: end all headers with guard comment 2018-10-23 10:02:24 +02:00
easy.c easy: fix win32 init to work without CURL_GLOBAL_WIN32 2019-02-18 02:12:12 -05:00
easyif.h whitespace fixes 2018-09-23 22:24:02 +00:00
escape.c snprintf: renamed and we now only use msnprintf() 2018-11-23 08:26:51 +01:00
escape.h whitespace fixes 2018-09-23 22:24:02 +00:00
file.c snprintf: renamed and we now only use msnprintf() 2018-11-23 08:26:51 +01:00
file.h whitespace fixes 2018-09-23 22:24:02 +00:00
fileinfo.c
fileinfo.h
firefox-db2pem.sh whitespace fixes 2018-09-23 22:24:02 +00:00
formdata.c
formdata.h
ftp.c pingpong: ignore regular timeout in disconnect phase 2018-12-17 12:33:00 +01:00
ftp.h url: use the URL API internally as well 2018-09-22 11:58:10 +02:00
ftplistparser.c ftp: avoid two unsigned int overflows in FTP listing parser 2018-11-09 23:08:46 +01:00
ftplistparser.h
getenv.c
getinfo.c urldata: rename easy_conn to just conn 2019-01-11 15:35:13 +01:00
getinfo.h
gopher.c gopher: fix memory leak from 9026083ddb 2018-12-13 15:06:17 +01:00
gopher.h
hash.c
hash.h
hmac.c
hostasyn.c dns: release sharelock as soon as possible 2019-02-11 13:34:11 +01:00
hostcheck.c axtls: removed 2018-11-01 10:29:53 +01:00
hostcheck.h whitespace fixes 2018-09-23 22:24:02 +00:00
hostip4.c snprintf: renamed and we now only use msnprintf() 2018-11-23 08:26:51 +01:00
hostip6.c snprintf: renamed and we now only use msnprintf() 2018-11-23 08:26:51 +01:00
hostip.c Curl_resolv: fix a gcc -Werror=maybe-uninitialized warning 2019-02-12 19:19:55 +01:00
hostip.h cleanup: make local functions static 2019-02-10 18:38:57 +01:00
hostsyn.c
http2.c http2: verify :athority in push promise requests 2019-02-20 08:18:02 +01:00
http2.h cleanup: make local functions static 2019-02-10 18:38:57 +01:00
http_chunks.c
http_chunks.h whitespace fixes 2018-09-23 22:24:02 +00:00
http_digest.c
http_digest.h
http_negotiate.c spnego_sspi: add support for channel binding 2019-02-01 09:56:27 +01:00
http_negotiate.h
http_ntlm.c spnego_sspi: add support for channel binding 2019-02-01 09:56:27 +01:00
http_ntlm.h
http_proxy.c urldata: rename easy_conn to just conn 2019-01-11 15:35:13 +01:00
http_proxy.h
http.c http: make adding a blank header thread-safe 2019-02-19 10:18:47 +01:00
http.h http: Implement trailing headers for chunked transfers 2018-12-14 10:10:48 +01:00
idn_win32.c
if2ip.c if2ip: remove unused function Curl_if_is_interface_name 2018-12-21 10:46:05 +01:00
if2ip.h if2ip: remove unused function Curl_if_is_interface_name 2018-12-21 10:46:05 +01:00
imap.c memcmp: avoid doing single char memcmp 2019-01-20 21:59:04 +01:00
imap.h imap: change from "FETCH" to "UID FETCH" 2018-09-06 10:57:48 +02:00
inet_ntop.c snprintf: renamed and we now only use msnprintf() 2018-11-23 08:26:51 +01:00
inet_ntop.h whitespace fixes 2018-09-23 22:24:02 +00:00
inet_pton.c
inet_pton.h whitespace fixes 2018-09-23 22:24:02 +00:00
krb5.c sendf: use failf() rather than Curl_failf() 2018-09-13 10:48:21 +02:00
ldap.c ldap: fix LDAP URL parsing regressions 2018-12-11 13:20:12 +01:00
libcurl.plist
libcurl.rc (lib)curl.rc: fixup for minor bugs 2018-12-10 00:10:04 +01:00
libcurl.vers.in
llist.c
llist.h whitespace fixes 2018-09-23 22:24:02 +00:00
Makefile.am configure: rewrite --enable-code-coverage 2019-01-26 00:29:50 +01:00
makefile.amiga whitespace fixes 2018-09-23 22:24:02 +00:00
makefile.dj whitespace fixes 2018-09-23 22:24:02 +00:00
Makefile.inc axtls: removed 2018-11-01 10:29:53 +01:00
Makefile.m32 whitespace fixes 2018-09-23 22:24:02 +00:00
Makefile.netware openssl: Remove SSLEAY leftovers 2018-11-17 21:36:10 +01:00
Makefile.vxworks
Makefile.Watcom openssl: Remove SSLEAY leftovers 2018-11-17 21:36:10 +01:00
md4.c checksrc: add COPYRIGHTYEAR check 2018-12-03 23:13:40 +01:00
md5.c axtls: removed 2018-11-01 10:29:53 +01:00
memdebug.c memdebug: bring back curl_mark_sclose 2019-02-14 17:34:55 +01:00
memdebug.h
mime.c mime: put the boundary buffer into the curl_mime struct 2019-02-12 22:55:32 +01:00
mime.h mime: put the boundary buffer into the curl_mime struct 2019-02-12 22:55:32 +01:00
mk-ca-bundle.pl
mk-ca-bundle.vbs
mprintf.c mprintf: avoid unsigned integer overflow warning 2018-11-02 11:07:04 +01:00
multi.c singlesocket: fix the 'sincebefore' placement 2019-02-20 08:15:32 +01:00
multihandle.h
multiif.h urldata: rename easy_conn to just conn 2019-01-11 15:35:13 +01:00
netrc.c netrc: don't ignore the login name specified with "--user" 2018-11-05 20:34:01 +01:00
netrc.h netrc: don't ignore the login name specified with "--user" 2018-11-05 20:34:01 +01:00
non-ascii.c non-ascii.c: fix typos in comments 2019-02-12 10:24:29 +01:00
non-ascii.h
nonblock.c nonblock: fix unused parameter warning 2018-10-14 21:07:45 +02:00
nonblock.h whitespace fixes 2018-09-23 22:24:02 +00:00
nwlib.c memory: ensure to check allocation results 2018-10-03 23:45:38 +02:00
nwos.c
openldap.c snprintf: renamed and we now only use msnprintf() 2018-11-23 08:26:51 +01:00
parsedate.c
parsedate.h whitespace fixes 2018-09-23 22:24:02 +00:00
pingpong.c pingpong: ignore regular timeout in disconnect phase 2018-12-17 12:33:00 +01:00
pingpong.h pingpong: ignore regular timeout in disconnect phase 2018-12-17 12:33:00 +01:00
pipeline.c
pipeline.h
pop3.c memcmp: avoid doing single char memcmp 2019-01-20 21:59:04 +01:00
pop3.h
progress.c snprintf: renamed and we now only use msnprintf() 2018-11-23 08:26:51 +01:00
progress.h whitespace fixes 2018-09-23 22:24:02 +00:00
psl.c
psl.h
rand.c rand: add comment to skip a clang-tidy false positive 2018-10-27 15:59:44 +02:00
rand.h rand: Fix a mismatch between comments in source and header. 2019-02-18 23:13:30 +01:00
rtsp.c cleanup: make local functions static 2019-02-10 18:38:57 +01:00
rtsp.h whitespace fixes 2018-09-23 22:24:02 +00:00
security.c snprintf: renamed and we now only use msnprintf() 2018-11-23 08:26:51 +01:00
select.c
select.h whitespace fixes 2018-09-23 22:24:02 +00:00
sendf.c snprintf: renamed and we now only use msnprintf() 2018-11-23 08:26:51 +01:00
sendf.h travis: add build for "configure --disable-verbose" 2018-10-18 14:51:49 +02:00
setopt.c cleanup: make local functions static 2019-02-10 18:38:57 +01:00
setopt.h
setup-os400.h
setup-vms.h
sha256.c
share.c
share.h
sigpipe.h sigpipe: if mbedTLS is used, ignore SIGPIPE 2019-01-28 12:03:33 +01:00
slist.c whitespace fixes 2018-09-23 22:24:02 +00:00
slist.h whitespace fixes 2018-09-23 22:24:02 +00:00
smb.c smb: fix incorrect path in request if connection reused 2018-12-19 09:52:36 +01:00
smb.h
smtp.c smtp: avoid risk of buffer overflow in strtol 2019-02-04 08:22:32 +01:00
smtp.h
sockaddr.h whitespace fixes 2018-09-23 22:24:02 +00:00
socks_gssapi.c snprintf: renamed and we now only use msnprintf() 2018-11-23 08:26:51 +01:00
socks_sspi.c snprintf: renamed and we now only use msnprintf() 2018-11-23 08:26:51 +01:00
socks.c whitespace fixes 2018-09-23 22:24:02 +00:00
socks.h whitespace fixes 2018-09-23 22:24:02 +00:00
speedcheck.c
speedcheck.h
splay.c whitespace fixes 2018-09-23 22:24:02 +00:00
splay.h
ssh-libssh.c libssh: do not let libssh create socket 2019-01-24 09:03:11 +01:00
ssh.c ssh: log the libssh2 error message when ssh session startup fails 2019-01-17 15:03:16 +01:00
ssh.h
strcase.c
strcase.h
strdup.c Curl_saferealloc: Fixed typo in docblock 2018-09-21 14:24:55 +02:00
strdup.h
strerror.c snprintf: renamed and we now only use msnprintf() 2018-11-23 08:26:51 +01:00
strerror.h
strtok.c
strtok.h
strtoofft.c
strtoofft.h
system_win32.c
system_win32.h
telnet.c snprintf: renamed and we now only use msnprintf() 2018-11-23 08:26:51 +01:00
telnet.h whitespace fixes 2018-09-23 22:24:02 +00:00
tftp.c snprintf: renamed and we now only use msnprintf() 2018-11-23 08:26:51 +01:00
tftp.h whitespace fixes 2018-09-23 22:24:02 +00:00
timeval.c Curl_now: figure out windows version in win32_init 2019-02-15 23:23:14 +01:00
timeval.h printf: introduce CURL_FORMAT_TIMEDIFF_T 2019-01-04 23:51:13 +01:00
transfer.c transfer.c: do not compute length of undefined hex buffer. 2019-02-14 16:03:24 +01:00
transfer.h whitespace fixes 2018-09-23 22:24:02 +00:00
url.c connection: never reuse CONNECT_ONLY conections 2019-02-19 22:50:02 +01:00
url.h urldata: rename easy_conn to just conn 2019-01-11 15:35:13 +01:00
urlapi-int.h tests: add urlapi unittest 2018-12-11 15:02:24 +01:00
urlapi.c cleanup: make local functions static 2019-02-10 18:38:57 +01:00
urldata.h connection: never reuse CONNECT_ONLY conections 2019-02-19 22:50:02 +01:00
version.c version.c: silent scan-build even when librtmp is not enabled 2019-02-16 01:04:22 +01:00
warnless.c cleanup: make local functions static 2019-02-10 18:38:57 +01:00
warnless.h cleanup: make local functions static 2019-02-10 18:38:57 +01:00
wildcard.c
wildcard.h
x509asn1.c x509asn1: cleanup and unify code layout 2019-02-19 16:03:19 +01:00
x509asn1.h