|
 |
9d7d3f |
From e6968d1d220891230bcca5340bfd364183ceaa31 Mon Sep 17 00:00:00 2001
|
|
|
9d7d3f |
From: Daniel Stenberg <daniel@haxx.se>
|
|
|
9d7d3f |
Date: Fri, 19 Jan 2018 13:19:25 +0100
|
|
|
9d7d3f |
Subject: [PATCH] http: prevent custom Authorization headers in redirects
|
|
|
9d7d3f |
|
|
|
9d7d3f |
... unless CURLOPT_UNRESTRICTED_AUTH is set to allow them. This matches how
|
|
|
9d7d3f |
curl already handles Authorization headers created internally.
|
|
|
9d7d3f |
|
|
|
9d7d3f |
Note: this changes behavior slightly, for the sake of reducing mistakes.
|
|
|
9d7d3f |
|
|
|
9d7d3f |
Added test 317 and 318 to verify.
|
|
|
9d7d3f |
|
|
|
9d7d3f |
Reported-by: Craig de Stigter
|
|
|
9d7d3f |
Bug: https://curl.haxx.se/docs/adv_2018-b3bf.html
|
|
|
9d7d3f |
|
|
|
9d7d3f |
Upstream-commit: af32cd3859336ab963591ca0df9b1e33a7ee066b
|
|
|
9d7d3f |
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
|
|
|
9d7d3f |
---
|
|
|
9d7d3f |
docs/libcurl/curl_easy_setopt.3 | 10 +++++
|
|
|
9d7d3f |
lib/http.c | 10 ++++-
|
|
|
9d7d3f |
lib/url.c | 2 +-
|
|
|
9d7d3f |
lib/urldata.h | 2 +-
|
|
|
9d7d3f |
tests/data/Makefile.am | 3 +-
|
|
|
9d7d3f |
tests/data/test317 | 94 ++++++++++++++++++++++++++++++++++++++++
|
|
|
9d7d3f |
tests/data/test318 | 95 +++++++++++++++++++++++++++++++++++++++++
|
|
|
9d7d3f |
7 files changed, 212 insertions(+), 4 deletions(-)
|
|
|
9d7d3f |
create mode 100644 tests/data/test317
|
|
|
9d7d3f |
create mode 100644 tests/data/test318
|
|
|
9d7d3f |
|
|
|
9d7d3f |
diff --git a/docs/libcurl/curl_easy_setopt.3 b/docs/libcurl/curl_easy_setopt.3
|
|
|
9d7d3f |
index 4ce8207..cbebfba 100644
|
|
|
9d7d3f |
--- a/docs/libcurl/curl_easy_setopt.3
|
|
|
9d7d3f |
+++ b/docs/libcurl/curl_easy_setopt.3
|
|
|
9d7d3f |
@@ -67,6 +67,16 @@ this when you debug/report problems. Another neat option for debugging is the
|
|
|
9d7d3f |
A parameter set to 1 tells the library to include the header in the body
|
|
|
9d7d3f |
output. This is only relevant for protocols that actually have headers
|
|
|
9d7d3f |
preceding the data (like HTTP).
|
|
|
9d7d3f |
+
|
|
|
9d7d3f |
+Custom headers are sent in all requests done by the easy handles, which
|
|
|
9d7d3f |
+implies that if you tell libcurl to follow redirects
|
|
|
9d7d3f |
+(\fICURLOPT_FOLLOWLOCATION(3)\fP), the same set of custom headers will be sent
|
|
|
9d7d3f |
+in the subsequent request. Redirects can of course go to other hosts and thus
|
|
|
9d7d3f |
+those servers will get all the contents of your custom headers too.
|
|
|
9d7d3f |
+
|
|
|
9d7d3f |
+Starting in 7.58.0, libcurl will specifically prevent "Authorization:" headers
|
|
|
9d7d3f |
+from being sent to other hosts than the first used one, unless specifically
|
|
|
9d7d3f |
+permitted with the \fICURLOPT_UNRESTRICTED_AUTH(3)\fP option.
|
|
|
9d7d3f |
.IP CURLOPT_NOPROGRESS
|
|
|
9d7d3f |
Pass a long. If set to 1, it tells the library to shut off the progress meter
|
|
|
9d7d3f |
completely. It will also prevent the \fICURLOPT_PROGRESSFUNCTION\fP from
|
|
|
9d7d3f |
diff --git a/lib/http.c b/lib/http.c
|
|
|
9d7d3f |
index b73e58c..c15208d 100644
|
|
|
9d7d3f |
--- a/lib/http.c
|
|
|
9d7d3f |
+++ b/lib/http.c
|
|
|
9d7d3f |
@@ -666,7 +666,7 @@ Curl_http_output_auth(struct connectdata *conn,
|
|
|
9d7d3f |
if(!data->state.this_is_a_follow ||
|
|
|
9d7d3f |
conn->bits.netrc ||
|
|
|
9d7d3f |
!data->state.first_host ||
|
|
|
9d7d3f |
- data->set.http_disable_hostname_check_before_authentication ||
|
|
|
9d7d3f |
+ data->set.allow_auth_to_other_hosts ||
|
|
|
9d7d3f |
Curl_raw_equal(data->state.first_host, conn->host.name)) {
|
|
|
9d7d3f |
result = output_auth_headers(conn, authhost, request, path, FALSE);
|
|
|
9d7d3f |
}
|
|
|
9d7d3f |
@@ -1550,6 +1550,14 @@ CURLcode Curl_add_custom_headers(struct connectdata *conn,
|
|
|
9d7d3f |
Connection: */
|
|
|
9d7d3f |
checkprefix("Connection", headers->data))
|
|
|
9d7d3f |
;
|
|
|
9d7d3f |
+ else if(checkprefix("Authorization:", headers->data) &&
|
|
|
9d7d3f |
+ /* be careful of sending this potentially sensitive header to
|
|
|
9d7d3f |
+ other hosts */
|
|
|
9d7d3f |
+ (conn->data->state.this_is_a_follow &&
|
|
|
9d7d3f |
+ conn->data->state.first_host &&
|
|
|
9d7d3f |
+ !conn->data->set.allow_auth_to_other_hosts &&
|
|
|
9d7d3f |
+ !strequal(conn->data->state.first_host, conn->host.name)))
|
|
|
9d7d3f |
+ ;
|
|
|
9d7d3f |
else {
|
|
|
9d7d3f |
CURLcode result = Curl_add_bufferf(req_buffer, "%s\r\n",
|
|
|
9d7d3f |
headers->data);
|
|
|
9d7d3f |
diff --git a/lib/url.c b/lib/url.c
|
|
|
9d7d3f |
index 71d4d8b..ba53131 100644
|
|
|
9d7d3f |
--- a/lib/url.c
|
|
|
9d7d3f |
+++ b/lib/url.c
|
|
|
9d7d3f |
@@ -912,7 +912,7 @@ CURLcode Curl_setopt(struct SessionHandle *data, CURLoption option,
|
|
|
9d7d3f |
* Send authentication (user+password) when following locations, even when
|
|
|
9d7d3f |
* hostname changed.
|
|
|
9d7d3f |
*/
|
|
|
9d7d3f |
- data->set.http_disable_hostname_check_before_authentication =
|
|
|
9d7d3f |
+ data->set.allow_auth_to_other_hosts =
|
|
|
9d7d3f |
(0 != va_arg(param, long))?TRUE:FALSE;
|
|
|
9d7d3f |
break;
|
|
|
9d7d3f |
|
|
|
9d7d3f |
diff --git a/lib/urldata.h b/lib/urldata.h
|
|
|
9d7d3f |
index b4f18e7..1dd62ae 100644
|
|
|
9d7d3f |
--- a/lib/urldata.h
|
|
|
9d7d3f |
+++ b/lib/urldata.h
|
|
|
9d7d3f |
@@ -1528,7 +1528,7 @@ struct UserDefined {
|
|
|
9d7d3f |
bool http_fail_on_error; /* fail on HTTP error codes >= 300 */
|
|
|
9d7d3f |
bool http_follow_location; /* follow HTTP redirects */
|
|
|
9d7d3f |
bool http_transfer_encoding; /* request compressed HTTP transfer-encoding */
|
|
|
9d7d3f |
- bool http_disable_hostname_check_before_authentication;
|
|
|
9d7d3f |
+ bool allow_auth_to_other_hosts;
|
|
|
9d7d3f |
bool include_header; /* include received protocol headers in data output */
|
|
|
9d7d3f |
bool http_set_referer; /* is a custom referer used */
|
|
|
9d7d3f |
bool http_auto_referer; /* set "correct" referer when following location: */
|
|
|
9d7d3f |
diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am
|
|
|
9d7d3f |
index 3b31581..56cb286 100644
|
|
|
9d7d3f |
--- a/tests/data/Makefile.am
|
|
|
9d7d3f |
+++ b/tests/data/Makefile.am
|
|
|
9d7d3f |
@@ -36,7 +36,8 @@ test276 test277 test278 test279 test280 test281 test282 test283 test284 \
|
|
|
9d7d3f |
test285 test286 test287 test288 test289 test290 test291 test292 test293 \
|
|
|
9d7d3f |
test294 test295 test296 test297 test298 test299 test300 test301 test302 \
|
|
|
9d7d3f |
test303 test304 test305 test306 test307 test308 test309 test310 test311 \
|
|
|
9d7d3f |
-test312 test313 test320 test321 test322 test323 test324 test350 test351 \
|
|
|
9d7d3f |
+test312 test313 test317 test318 \
|
|
|
9d7d3f |
+test320 test321 test322 test323 test324 test350 test351 \
|
|
|
9d7d3f |
test352 test353 test354 test400 test401 test402 test403 test404 test405 \
|
|
|
9d7d3f |
test406 test407 test408 test409 test500 test501 test502 test503 test504 \
|
|
|
9d7d3f |
test505 test506 test507 test508 test510 test511 test512 test513 test514 \
|
|
|
9d7d3f |
diff --git a/tests/data/test317 b/tests/data/test317
|
|
|
9d7d3f |
new file mode 100644
|
|
|
9d7d3f |
index 0000000..c6d8697
|
|
|
9d7d3f |
--- /dev/null
|
|
|
9d7d3f |
+++ b/tests/data/test317
|
|
|
9d7d3f |
@@ -0,0 +1,94 @@
|
|
|
9d7d3f |
+<testcase>
|
|
|
9d7d3f |
+<info>
|
|
|
9d7d3f |
+<keywords>
|
|
|
9d7d3f |
+HTTP
|
|
|
9d7d3f |
+HTTP proxy
|
|
|
9d7d3f |
+HTTP Basic auth
|
|
|
9d7d3f |
+HTTP proxy Basic auth
|
|
|
9d7d3f |
+followlocation
|
|
|
9d7d3f |
+</keywords>
|
|
|
9d7d3f |
+</info>
|
|
|
9d7d3f |
+#
|
|
|
9d7d3f |
+# Server-side
|
|
|
9d7d3f |
+<reply>
|
|
|
9d7d3f |
+<data>
|
|
|
9d7d3f |
+HTTP/1.1 302 OK
|
|
|
9d7d3f |
+Date: Thu, 09 Nov 2010 14:49:00 GMT
|
|
|
9d7d3f |
+Server: test-server/fake swsclose
|
|
|
9d7d3f |
+Content-Type: text/html
|
|
|
9d7d3f |
+Funny-head: yesyes
|
|
|
9d7d3f |
+Location: http://goto.second.host.now/3170002
|
|
|
9d7d3f |
+Content-Length: 8
|
|
|
9d7d3f |
+Connection: close
|
|
|
9d7d3f |
+
|
|
|
9d7d3f |
+contents
|
|
|
9d7d3f |
+</data>
|
|
|
9d7d3f |
+<data2>
|
|
|
9d7d3f |
+HTTP/1.1 200 OK
|
|
|
9d7d3f |
+Date: Thu, 09 Nov 2010 14:49:00 GMT
|
|
|
9d7d3f |
+Server: test-server/fake swsclose
|
|
|
9d7d3f |
+Content-Type: text/html
|
|
|
9d7d3f |
+Funny-head: yesyes
|
|
|
9d7d3f |
+Content-Length: 9
|
|
|
9d7d3f |
+
|
|
|
9d7d3f |
+contents
|
|
|
9d7d3f |
+</data2>
|
|
|
9d7d3f |
+
|
|
|
9d7d3f |
+<datacheck>
|
|
|
9d7d3f |
+HTTP/1.1 302 OK
|
|
|
9d7d3f |
+Date: Thu, 09 Nov 2010 14:49:00 GMT
|
|
|
9d7d3f |
+Server: test-server/fake swsclose
|
|
|
9d7d3f |
+Content-Type: text/html
|
|
|
9d7d3f |
+Funny-head: yesyes
|
|
|
9d7d3f |
+Location: http://goto.second.host.now/3170002
|
|
|
9d7d3f |
+Content-Length: 8
|
|
|
9d7d3f |
+Connection: close
|
|
|
9d7d3f |
+
|
|
|
9d7d3f |
+HTTP/1.1 200 OK
|
|
|
9d7d3f |
+Date: Thu, 09 Nov 2010 14:49:00 GMT
|
|
|
9d7d3f |
+Server: test-server/fake swsclose
|
|
|
9d7d3f |
+Content-Type: text/html
|
|
|
9d7d3f |
+Funny-head: yesyes
|
|
|
9d7d3f |
+Content-Length: 9
|
|
|
9d7d3f |
+
|
|
|
9d7d3f |
+contents
|
|
|
9d7d3f |
+</datacheck>
|
|
|
9d7d3f |
+</reply>
|
|
|
9d7d3f |
+
|
|
|
9d7d3f |
+#
|
|
|
9d7d3f |
+# Client-side
|
|
|
9d7d3f |
+<client>
|
|
|
9d7d3f |
+<server>
|
|
|
9d7d3f |
+http
|
|
|
9d7d3f |
+</server>
|
|
|
9d7d3f |
+ <name>
|
|
|
9d7d3f |
+HTTP with custom Authorization: and redirect to new host
|
|
|
9d7d3f |
+ </name>
|
|
|
9d7d3f |
+ <command>
|
|
|
9d7d3f |
+http://first.host.it.is/we/want/that/page/317 -x %HOSTIP:%HTTPPORT -H "Authorization: s3cr3t" --proxy-user testing:this --location
|
|
|
9d7d3f |
+</command>
|
|
|
9d7d3f |
+</client>
|
|
|
9d7d3f |
+
|
|
|
9d7d3f |
+#
|
|
|
9d7d3f |
+# Verify data after the test has been "shot"
|
|
|
9d7d3f |
+<verify>
|
|
|
9d7d3f |
+<strip>
|
|
|
9d7d3f |
+^User-Agent:.*
|
|
|
9d7d3f |
+</strip>
|
|
|
9d7d3f |
+<protocol>
|
|
|
9d7d3f |
+GET http://first.host.it.is/we/want/that/page/317 HTTP/1.1
|
|
|
9d7d3f |
+Proxy-Authorization: Basic dGVzdGluZzp0aGlz
|
|
|
9d7d3f |
+Host: first.host.it.is
|
|
|
9d7d3f |
+Accept: */*
|
|
|
9d7d3f |
+Proxy-Connection: Keep-Alive
|
|
|
9d7d3f |
+Authorization: s3cr3t
|
|
|
9d7d3f |
+
|
|
|
9d7d3f |
+GET http://goto.second.host.now/3170002 HTTP/1.1
|
|
|
9d7d3f |
+Proxy-Authorization: Basic dGVzdGluZzp0aGlz
|
|
|
9d7d3f |
+Host: goto.second.host.now
|
|
|
9d7d3f |
+Accept: */*
|
|
|
9d7d3f |
+Proxy-Connection: Keep-Alive
|
|
|
9d7d3f |
+
|
|
|
9d7d3f |
+</protocol>
|
|
|
9d7d3f |
+</verify>
|
|
|
9d7d3f |
+</testcase>
|
|
|
9d7d3f |
diff --git a/tests/data/test318 b/tests/data/test318
|
|
|
9d7d3f |
new file mode 100644
|
|
|
9d7d3f |
index 0000000..838d1ba
|
|
|
9d7d3f |
--- /dev/null
|
|
|
9d7d3f |
+++ b/tests/data/test318
|
|
|
9d7d3f |
@@ -0,0 +1,95 @@
|
|
|
9d7d3f |
+<testcase>
|
|
|
9d7d3f |
+<info>
|
|
|
9d7d3f |
+<keywords>
|
|
|
9d7d3f |
+HTTP
|
|
|
9d7d3f |
+HTTP proxy
|
|
|
9d7d3f |
+HTTP Basic auth
|
|
|
9d7d3f |
+HTTP proxy Basic auth
|
|
|
9d7d3f |
+followlocation
|
|
|
9d7d3f |
+</keywords>
|
|
|
9d7d3f |
+</info>
|
|
|
9d7d3f |
+#
|
|
|
9d7d3f |
+# Server-side
|
|
|
9d7d3f |
+<reply>
|
|
|
9d7d3f |
+<data>
|
|
|
9d7d3f |
+HTTP/1.1 302 OK
|
|
|
9d7d3f |
+Date: Thu, 09 Nov 2010 14:49:00 GMT
|
|
|
9d7d3f |
+Server: test-server/fake swsclose
|
|
|
9d7d3f |
+Content-Type: text/html
|
|
|
9d7d3f |
+Funny-head: yesyes
|
|
|
9d7d3f |
+Location: http://goto.second.host.now/3180002
|
|
|
9d7d3f |
+Content-Length: 8
|
|
|
9d7d3f |
+Connection: close
|
|
|
9d7d3f |
+
|
|
|
9d7d3f |
+contents
|
|
|
9d7d3f |
+</data>
|
|
|
9d7d3f |
+<data2>
|
|
|
9d7d3f |
+HTTP/1.1 200 OK
|
|
|
9d7d3f |
+Date: Thu, 09 Nov 2010 14:49:00 GMT
|
|
|
9d7d3f |
+Server: test-server/fake swsclose
|
|
|
9d7d3f |
+Content-Type: text/html
|
|
|
9d7d3f |
+Funny-head: yesyes
|
|
|
9d7d3f |
+Content-Length: 9
|
|
|
9d7d3f |
+
|
|
|
9d7d3f |
+contents
|
|
|
9d7d3f |
+</data2>
|
|
|
9d7d3f |
+
|
|
|
9d7d3f |
+<datacheck>
|
|
|
9d7d3f |
+HTTP/1.1 302 OK
|
|
|
9d7d3f |
+Date: Thu, 09 Nov 2010 14:49:00 GMT
|
|
|
9d7d3f |
+Server: test-server/fake swsclose
|
|
|
9d7d3f |
+Content-Type: text/html
|
|
|
9d7d3f |
+Funny-head: yesyes
|
|
|
9d7d3f |
+Location: http://goto.second.host.now/3180002
|
|
|
9d7d3f |
+Content-Length: 8
|
|
|
9d7d3f |
+Connection: close
|
|
|
9d7d3f |
+
|
|
|
9d7d3f |
+HTTP/1.1 200 OK
|
|
|
9d7d3f |
+Date: Thu, 09 Nov 2010 14:49:00 GMT
|
|
|
9d7d3f |
+Server: test-server/fake swsclose
|
|
|
9d7d3f |
+Content-Type: text/html
|
|
|
9d7d3f |
+Funny-head: yesyes
|
|
|
9d7d3f |
+Content-Length: 9
|
|
|
9d7d3f |
+
|
|
|
9d7d3f |
+contents
|
|
|
9d7d3f |
+</datacheck>
|
|
|
9d7d3f |
+</reply>
|
|
|
9d7d3f |
+
|
|
|
9d7d3f |
+#
|
|
|
9d7d3f |
+# Client-side
|
|
|
9d7d3f |
+<client>
|
|
|
9d7d3f |
+<server>
|
|
|
9d7d3f |
+http
|
|
|
9d7d3f |
+</server>
|
|
|
9d7d3f |
+ <name>
|
|
|
9d7d3f |
+HTTP with custom Authorization: and redirect to new host
|
|
|
9d7d3f |
+ </name>
|
|
|
9d7d3f |
+ <command>
|
|
|
9d7d3f |
+http://first.host.it.is/we/want/that/page/318 -x %HOSTIP:%HTTPPORT -H "Authorization: s3cr3t" --proxy-user testing:this --location-trusted
|
|
|
9d7d3f |
+</command>
|
|
|
9d7d3f |
+</client>
|
|
|
9d7d3f |
+
|
|
|
9d7d3f |
+#
|
|
|
9d7d3f |
+# Verify data after the test has been "shot"
|
|
|
9d7d3f |
+<verify>
|
|
|
9d7d3f |
+<strip>
|
|
|
9d7d3f |
+^User-Agent:.*
|
|
|
9d7d3f |
+</strip>
|
|
|
9d7d3f |
+<protocol>
|
|
|
9d7d3f |
+GET http://first.host.it.is/we/want/that/page/318 HTTP/1.1
|
|
|
9d7d3f |
+Proxy-Authorization: Basic dGVzdGluZzp0aGlz
|
|
|
9d7d3f |
+Host: first.host.it.is
|
|
|
9d7d3f |
+Accept: */*
|
|
|
9d7d3f |
+Proxy-Connection: Keep-Alive
|
|
|
9d7d3f |
+Authorization: s3cr3t
|
|
|
9d7d3f |
+
|
|
|
9d7d3f |
+GET http://goto.second.host.now/3180002 HTTP/1.1
|
|
|
9d7d3f |
+Proxy-Authorization: Basic dGVzdGluZzp0aGlz
|
|
|
9d7d3f |
+Host: goto.second.host.now
|
|
|
9d7d3f |
+Accept: */*
|
|
|
9d7d3f |
+Proxy-Connection: Keep-Alive
|
|
|
9d7d3f |
+Authorization: s3cr3t
|
|
|
9d7d3f |
+
|
|
|
9d7d3f |
+</protocol>
|
|
|
9d7d3f |
+</verify>
|
|
|
9d7d3f |
+</testcase>
|
|
|
9d7d3f |
--
|
|
|
9d7d3f |
2.13.6
|
|
|
9d7d3f |
|