You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
48 lines
1.6 KiB
48 lines
1.6 KiB
From 2b0994c29a721c91c572cff7808c572a24d251eb Mon Sep 17 00:00:00 2001 |
|
From: Daniel Stenberg <daniel@haxx.se> |
|
Date: Thu, 23 Nov 2023 08:15:47 +0100 |
|
Subject: [PATCH] cookie: lowercase the domain names before PSL checks |
|
|
|
Reported-by: Harry Sintonen |
|
|
|
Closes #12387 |
|
--- |
|
lib/cookie.c | 24 ++++++++++++++++-------- |
|
1 file changed, 16 insertions(+), 8 deletions(-) |
|
|
|
diff --git a/lib/cookie.c b/lib/cookie.c |
|
index 568cf537ad1b1f..9095cea3e97f22 100644 |
|
--- a/lib/cookie.c |
|
+++ b/lib/cookie.c |
|
@@ -1027,15 +1027,23 @@ Curl_cookie_add(struct Curl_easy *data, |
|
* dereference it. |
|
*/ |
|
if(data && (domain && co->domain && !isip(co->domain))) { |
|
- const psl_ctx_t *psl = Curl_psl_use(data); |
|
- int acceptable; |
|
- |
|
- if(psl) { |
|
- acceptable = psl_is_cookie_domain_acceptable(psl, domain, co->domain); |
|
- Curl_psl_release(data); |
|
+ bool acceptable = FALSE; |
|
+ char lcase[256]; |
|
+ char lcookie[256]; |
|
+ size_t dlen = strlen(domain); |
|
+ size_t clen = strlen(co->domain); |
|
+ if((dlen < sizeof(lcase)) && (clen < sizeof(lcookie))) { |
|
+ const psl_ctx_t *psl = Curl_psl_use(data); |
|
+ if(psl) { |
|
+ /* the PSL check requires lowercase domain name and pattern */ |
|
+ Curl_strntolower(lcase, domain, dlen + 1); |
|
+ Curl_strntolower(lcookie, co->domain, clen + 1); |
|
+ acceptable = psl_is_cookie_domain_acceptable(psl, lcase, lcookie); |
|
+ Curl_psl_release(data); |
|
+ } |
|
+ else |
|
+ acceptable = !bad_domain(domain); |
|
} |
|
- else |
|
- acceptable = !bad_domain(domain); |
|
|
|
if(!acceptable) { |
|
infof(data, "cookie '%s' dropped, domain '%s' must not "
|
|
|