51beed175d
Daniel Stenberg
2026-05-16
Subject
cookie: trim trailing dots when checking PSL
Binary
No binary (build failed)
Architecture & Compiler Flags
—
Build Log
(log yok)
Commit Diff GitHub →
lib/cookie.c+11 -2
| @@ -779,12 +779,21 @@ static bool is_public_suffix(struct Curl_easy *data, | |
| char lcookie[256]; | |
| size_t dlen = strlen(domain); | |
| size_t clen = strlen(co->domain); | |
| + | |
| + | /* trim trailing dots */ |
| + | if(dlen && (domain[dlen - 1] == '.')) |
| + | dlen--; |
| + | if(clen && (co->domain[clen - 1] == '.')) |
| + | clen--; |
| + | |
| if((dlen < sizeof(lcase)) && (clen < sizeof(lcookie))) { | |
| const psl_ctx_t *psl = Curl_psl_use(data); | |
| if(psl) { | |
| /* the PSL check requires lowercase domain name and pattern */ | |
| - | Curl_strntolower(lcase, domain, dlen + 1); |
| - | Curl_strntolower(lcookie, co->domain, clen + 1); |
| + | Curl_strntolower(lcase, domain, dlen); |
| + | lcase[dlen] = 0; |
| + | Curl_strntolower(lcookie, co->domain, clen); |
| + | lcookie[clen] = 0; |
| acceptable = psl_is_cookie_domain_acceptable(psl, lcase, lcookie); | |
| Curl_psl_release(data); | |
| } | |
tests/data/Makefile.am+1 -1
| @@ -214,7 +214,7 @@ test1596 test1597 test1598 test1599 test1600 test1601 test1602 test1603 \ | |
| test1604 test1605 test1606 test1607 test1608 test1609 test1610 test1611 \ | |
| test1612 test1613 test1614 test1615 test1616 test1617 test1618 test1619 \ | |
| test1620 test1621 test1622 test1623 test1624 test1625 test1626 test1627 \ | |
| - | test1628 \ |
| + | test1628 test1629 \ |
| \ | |
| test1630 test1631 test1632 test1633 test1634 test1635 test1636 test1637 \ | |
| test1638 test1639 test1640 test1641 test1642 test1643 test1644 test1645 \ | |
tests/data/test1629+53 -0
| @@ -0,0 +1,53 @@ | |
| + | <?xml version="1.0" encoding="US-ASCII"?> |
| + | <testcase> |
| + | <info> |
| + | <keywords> |
| + | HTTP |
| + | HTTP GET |
| + | </keywords> |
| + | </info> |
| + | |
| + | # Server-side |
| + | <reply> |
| + | <data crlf="headers"> |
| + | HTTP/1.1 200 OK |
| + | Content-Length: 6 |
| + | Set-Cookie: something=1; Domain=co.uk.; Path=/ |
| + | |
| + | -foo- |
| + | </data> |
| + | </reply> |
| + | |
| + | # Client-side |
| + | <client> |
| + | <features> |
| + | PSL |
| + | cookies |
| + | </features> |
| + | <server> |
| + | http |
| + | </server> |
| + | <name> |
| + | cookies with trailing dot after PSL domain |
| + | </name> |
| + | <command> |
| + | http://foo.co.uk.:%HTTPPORT/ http://bar.co.uk.:%HTTPPORT/ -b "" --resolve foo.co.uk.:%HTTPPORT:%HOSTIP --resolve bar.co.uk.:%HTTPPORT:%HOSTIP |
| + | </command> |
| + | </client> |
| + | |
| + | # Verify data after the test has been "shot" |
| + | <verify> |
| + | <protocol crlf="headers"> |
| + | GET / HTTP/1.1 |
| + | Host: foo.co.uk.:%HTTPPORT |
| + | User-Agent: curl/%VERSION |
| + | Accept: */* |
| + | |
| + | GET / HTTP/1.1 |
| + | Host: bar.co.uk.:%HTTPPORT |
| + | User-Agent: curl/%VERSION |
| + | Accept: */* |
| + | |
| + | </protocol> |
| + | </verify> |
| + | </testcase> |