ce35977303
Filippo Tedeschi
2026-09-21
Subject
getinfo: make sure CURLINFO_REDIRECT_URL does not contain creds
Binary
No binary (build failed)
Architecture & Compiler Flags
—
Build Log
(log yok)
Commit Diff GitHub →
lib/http.c+20 -0
| @@ -1294,6 +1294,26 @@ CURLcode Curl_http_follow(struct Curl_easy *data, const char *newurl, | |
| if(type == FOLLOW_FAKE) { | |
| /* we are only figuring out the new URL if we would have followed locations | |
| but now we are done so we can get out! */ | |
| + | if(!uc) { |
| + | CURLU *u = curl_url(); |
| + | char *nocred = NULL; |
| + | |
| + | if(!u) { |
| + | curlx_free(follow_url); |
| + | return CURLE_OUT_OF_MEMORY; |
| + | } |
| + | if(!curl_url_set(u, CURLUPART_URL, follow_url, |
| + | CURLU_NON_SUPPORT_SCHEME | |
| + | (data->set.path_as_is ? CURLU_PATH_AS_IS : 0)) && |
| + | !curl_url_set(u, CURLUPART_USER, NULL, 0) && |
| + | !curl_url_set(u, CURLUPART_PASSWORD, NULL, 0)) |
| + | (void)curl_url_get(u, CURLUPART_URL, &nocred, CURLU_GET_EMPTY); |
| + | curl_url_cleanup(u); |
| + | if(nocred) { |
| + | curlx_free(follow_url); |
| + | follow_url = nocred; |
| + | } |
| + | } |
| data->info.wouldredirect = follow_url; | |
| if(reachedmax) { | |
tests/data/Makefile.am+1 -0
| @@ -1751,6 +1751,7 @@ TESTCASES = \ | |
| test1851 \ | |
| test1862 \ | |
| test1876 \ | |
| + | test1877 \ |
| test1900 \ | |
| test1901 \ | |
| test1902 \ | |
tests/data/test1877+54 -0
| @@ -0,0 +1,54 @@ | |
| + | <?xml version="1.0" encoding="US-ASCII"?> |
| + | <testcase> |
| + | <info> |
| + | <keywords> |
| + | netrc |
| + | CURLINFO_REDIRECT_URL |
| + | </keywords> |
| + | </info> |
| + | |
| + | # Server-side |
| + | <reply> |
| + | <data crlf="headers" nocheck="yes"> |
| + | HTTP/1.1 301 redir |
| + | Content-Length: 0 |
| + | Content-Type: text/html |
| + | Location: %TESTNUMBER0002 |
| + | |
| + | </data> |
| + | </reply> |
| + | |
| + | # Client-side |
| + | <client> |
| + | <server> |
| + | http |
| + | </server> |
| + | <name> |
| + | verify no credentials present in redirect URL after redirect |
| + | </name> |
| + | <file name="%LOGDIR/netrc"> |
| + | machine %HOSTIP |
| + | login netrcuser |
| + | password netrcSECRET123 |
| + | </file> |
| + | |
| + | <command option="no-include"> |
| + | http://%HOSTIP:%HTTPPORT/%TESTNUMBER --netrc-optional --netrc-file %LOGDIR/netrc -w 'REDIRECT_URL=%{redirect_url}\n' |
| + | </command> |
| + | </client> |
| + | |
| + | # Verify data after the test has been "shot" |
| + | <verify> |
| + | <protocol crlf="headers"> |
| + | GET /%TESTNUMBER HTTP/1.1 |
| + | Host: %HOSTIP:%HTTPPORT |
| + | Authorization: Basic %b64[netrcuser:netrcSECRET123]b64% |
| + | User-Agent: curl/%VERSION |
| + | Accept: */* |
| + | |
| + | </protocol> |
| + | <stdout> |
| + | REDIRECT_URL=http://%HOSTIP:%HTTPPORT/%TESTNUMBER0002 |
| + | </stdout> |
| + | </verify> |
| + | </testcase> |