e1fdbdd16f
Daniel Stenberg
2026-03-26
Subject
hsts: when a dupe host adds subdomains, use that
Binary
No binary (build failed)
Architecture & Compiler Flags
—
Build Log
(log yok)
Commit Diff GitHub →
docs/tests/FILEFORMAT.md +4 -1lib/curlx/strparse.c +9 -0lib/curlx/strparse.h +1 -0lib/hsts.c +11 -1tests/data/Makefile.am +1 -1tests/data/test1638 +79 -0
docs/tests/FILEFORMAT.md+4 -1
| @@ -636,7 +636,7 @@ parameter is the not negative integer number of seconds for the delay. This | |
| 'delay' attribute is intended for specific test cases, and normally not | |
| needed. | |
| - | ### `<file name="%LOGDIR/filename" [nonewline="yes"][crlf="yes"]>` |
| + | ### `<file name="%LOGDIR/filename" [options]>` |
| This creates the named file with this content before the test case is run, | |
| which is useful if the test case needs a file to act on. | |
| @@ -646,6 +646,9 @@ off. | |
| `crlf=yes` forces the newlines to become CRLF even if not written so in the | |
| test. | |
| + | `mode="text"` normalizes the line endings to make them compare as text on all |
| + | platforms. |
| + | |
| ### `<file1>` | |
| 1 to 4 can be appended to 'file' to create more files. | |
lib/curlx/strparse.c+9 -0
| @@ -35,6 +35,15 @@ void curlx_str_assign(struct Curl_str *out, const char *str, size_t len) | |
| out->len = len; | |
| } | |
| + | /* remove bytes from the end of the string, never remove more bytes than what |
| + | the string holds! */ |
| + | void curlx_str_trim(struct Curl_str *out, size_t len) |
| + | { |
| + | DEBUGASSERT(out); |
| + | DEBUGASSERT(out->len >= len); |
| + | out->len -= len; |
| + | } |
| + | |
| /* Get a word until the first DELIM or end of string. At least one byte long. | |
| return non-zero on error */ | |
| int curlx_str_until(const char **linep, struct Curl_str *out, | |
lib/curlx/strparse.h+1 -0
| @@ -44,6 +44,7 @@ struct Curl_str { | |
| void curlx_str_init(struct Curl_str *out); | |
| void curlx_str_assign(struct Curl_str *out, const char *str, size_t len); | |
| + | void curlx_str_trim(struct Curl_str *out, size_t len); |
| #define curlx_str(x) ((x)->str) | |
| #define curlx_strlen(x) ((x)->len) | |
lib/hsts.c+11 -1
| @@ -407,6 +407,7 @@ static CURLcode hsts_add(struct hsts *h, const char *line) | |
| char dbuf[MAX_HSTS_DATELEN + 1]; | |
| time_t expires = 0; | |
| const char *hp = curlx_str(&host); | |
| + | size_t hlen; |
| /* The date parser works on a null-terminated string. The maximum length | |
| is upheld by curlx_str_quotedword(). */ | |
| @@ -420,17 +421,26 @@ static CURLcode hsts_add(struct hsts *h, const char *line) | |
| if(hp[0] == '.') { | |
| curlx_str_nudge(&host, 1); | |
| + | hp = curlx_str(&host); |
| subdomain = TRUE; | |
| } | |
| + | hlen = curlx_strlen(&host); |
| + | if(hlen && (hp[hlen - 1] == '.')) |
| + | /* strip off any trailing dot */ |
| + | curlx_str_trim(&host, 1); |
| + | |
| /* only add it if not already present */ | |
| e = Curl_hsts(h, curlx_str(&host), curlx_strlen(&host), subdomain); | |
| if(!e) | |
| result = hsts_create(h, curlx_str(&host), curlx_strlen(&host), | |
| subdomain, expires); | |
| else if(curlx_str_casecompare(&host, e->host)) { | |
| - | /* the same hostname, use the largest expire time */ |
| + | /* the same hostname, use the largest expire time and keep the |
| + | strictest subdomain policy */ |
| if(expires > e->expires) | |
| e->expires = expires; | |
| + | if(subdomain) |
| + | e->includeSubDomains = TRUE; |
| } | |
| if(result) | |
| return result; | |
tests/data/Makefile.am+1 -1
| @@ -217,7 +217,7 @@ test1614 test1615 test1616 test1617 test1618 \ | |
| test1620 test1621 test1622 test1623 test1624 test1625 test1626 test1627 \ | |
| \ | |
| test1630 test1631 test1632 test1633 test1634 test1635 test1636 test1637 \ | |
| - | \ |
| + | test1638 \ |
| test1640 test1641 test1642 test1643 \ | |
| \ | |
| test1650 test1651 test1652 test1653 test1654 test1655 test1656 test1657 \ | |
tests/data/test1638+79 -0
| @@ -0,0 +1,79 @@ | |
| + | <?xml version="1.0" encoding="US-ASCII"?> |
| + | <testcase> |
| + | <info> |
| + | <keywords> |
| + | HTTP |
| + | HTTP proxy |
| + | HSTS |
| + | </keywords> |
| + | </info> |
| + | |
| + | <reply> |
| + | |
| + | # we use this as response to a CONNECT |
| + | <connect crlf="headers" nocheck="yes"> |
| + | HTTP/1.1 200 not OK at all |
| + | Date: Tue, 09 Nov 2010 14:49:00 GMT |
| + | Server: test-server/fake |
| + | Connection: close |
| + | Funny-head: yesyes |
| + | |
| + | </connect> |
| + | |
| + | <data crlf="headers" nocheck="yes"> |
| + | HTTP/1.1 200 not OK at all |
| + | Date: Tue, 09 Nov 2010 14:49:00 GMT |
| + | Server: test-server/fake |
| + | Content-Length: 6 |
| + | Connection: close |
| + | Funny-head: yesyes |
| + | |
| + | -foo- |
| + | </data> |
| + | </reply> |
| + | |
| + | <client> |
| + | <server> |
| + | http |
| + | </server> |
| + | <features> |
| + | HSTS |
| + | proxy |
| + | https |
| + | large-time |
| + | </features> |
| + | |
| + | <file name="%LOGDIR/hsts%TESTNUMBER"> |
| + | # comment in input file |
| + | foo.example. "20391001 04:47:41" |
| + | .foo.example. "20291001 04:47:41" |
| + | </file> |
| + | |
| + | <name> |
| + | HSTS duplicate domains where the update adds subdomains |
| + | </name> |
| + | <command> |
| + | -x http://%HOSTIP:%HTTPPORT http://this.hsts.example/%TESTNUMBER --hsts %LOGDIR/hsts%TESTNUMBER |
| + | </command> |
| + | <disable> |
| + | test-duphandle |
| + | </disable> |
| + | </client> |
| + | |
| + | <verify> |
| + | <protocol crlf="headers"> |
| + | GET http://this.hsts.example/%TESTNUMBER HTTP/1.1 |
| + | Host: this.hsts.example |
| + | User-Agent: curl/%VERSION |
| + | Accept: */* |
| + | Proxy-Connection: Keep-Alive |
| + | |
| + | </protocol> |
| + | <file name="%LOGDIR/hsts%TESTNUMBER" mode="text"> |
| + | # Your HSTS cache. https://curl.se/docs/hsts.html |
| + | # This file was generated by libcurl! Edit at your own risk. |
| + | .foo.example "20391001 04:47:41" |
| + | </file> |
| + | |
| + | </verify> |
| + | </testcase> |