Skip to content

Commit dd4d1a2

Browse files
bagderbagder
committed
transfer: clear credentials when redirecting to absolute URL
Make sure the user and password for the second request is taken from the redirected-to URL. Add test case 899 to verify. Reported-by: James Lucas Fixes curl#11410 Closes curl#11412
1 parent def99e0 commit dd4d1a2

File tree

4 files changed

+91
-24
lines changed

4 files changed

+91
-24
lines changed

‎lib/transfer.c

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1554,10 +1554,15 @@ CURLcode Curl_follow(struct Curl_easy *data,
15541554

15551555
if((type != FOLLOW_RETRY) &&
15561556
(data->req.httpcode != 401) && (data->req.httpcode != 407) &&
1557-
Curl_is_absolute_url(newurl, NULL, 0, FALSE))
1557+
Curl_is_absolute_url(newurl, NULL, 0, FALSE)) {
15581558
/* If this is not redirect due to a 401 or 407 response and an absolute
15591559
URL: don't allow a custom port number */
15601560
disallowport = TRUE;
1561+
if(!data->set.allow_auth_to_other_hosts) {
1562+
Curl_safefree(data->state.aptr.user);
1563+
Curl_safefree(data->state.aptr.passwd);
1564+
}
1565+
}
15611566

15621567
DEBUGASSERT(data->state.uh);
15631568
uc = curl_url_set(data->state.uh, CURLUPART_URL, newurl,

‎lib/url.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1864,7 +1864,7 @@ static CURLcode parseurlandfillconn(struct Curl_easy *data,
18641864
* User name and password set with their own options override the
18651865
* credentials possibly set in the URL.
18661866
*/
1867-
if(!data->state.aptr.passwd) {
1867+
if(!data->set.str[STRING_PASSWORD]) {
18681868
uc = curl_url_get(uh, CURLUPART_PASSWORD, &data->state.up.password, 0);
18691869
if(!uc) {
18701870
char *decoded;

‎tests/data/Makefile.inc

Lines changed: 20 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -102,28 +102,26 @@ test700 test701 test702 test703 test704 test705 test706 test707 test708 \
102102
test709 test710 test711 test712 test713 test714 test715 test716 test717 \
103103
test718 test719 test720 test721 \
104104
\
105-
test799 \
106-
test800 test801 test802 test803 test804 test805 test806 test807 test808 \
107-
test809 test810 test811 test812 test813 test814 test815 test816 test817 \
108-
test818 test819 test820 test821 test822 test823 test824 test825 test826 \
109-
test827 test828 test829 test830 test831 test832 test833 test834 test835 \
110-
test836 test837 test838 test839 test840 test841 test842 test843 test844 \
111-
test845 test846 test847 test848 test849 test850 test851 test852 test853 \
112-
test854 test855 test856 test857 test858 test859 test860 test861 test862 \
113-
test863 test864 test865 test866 test867 test868 test869 test870 test871 \
114-
test872 test873 test874 test875 test876 test877 test878 test879 test880 \
115-
test881 test882 test883 test884 test885 test886 test887 test888 test889 \
116-
test890 test891 test892 test893 test894 test895 test896 test897 test898 \
117-
\
118-
test900 test901 test902 test903 test904 test905 test906 test907 test908 \
119-
test909 test910 test911 test912 test913 test914 test915 test916 test917 \
120-
test918 test919 test920 test921 test922 test923 test924 test925 test926 \
121-
test927 test928 test929 test930 test931 test932 test933 test934 test935 \
122-
test936 test937 test938 test939 test940 test941 test942 test943 test944 \
123-
test945 test946 test947 test948 test949 test950 test951 test952 test953 \
124-
test954 test955 test956 test957 test958 test959 test960 test961 test962 \
125-
test963 test964 test965 test966 test967 test968 test969 test970 test971 \
126-
test972 test973 test974 test975 test976 test977 test978 \
105+
test799 test800 test801 test802 test803 test804 test805 test806 test807 \
106+
test808 test809 test810 test811 test812 test813 test814 test815 test816 \
107+
test817 test818 test819 test820 test821 test822 test823 test824 test825 \
108+
test826 test827 test828 test829 test830 test831 test832 test833 test834 \
109+
test835 test836 test837 test838 test839 test840 test841 test842 test843 \
110+
test844 test845 test846 test847 test848 test849 test850 test851 test852 \
111+
test853 test854 test855 test856 test857 test858 test859 test860 test861 \
112+
test862 test863 test864 test865 test866 test867 test868 test869 test870 \
113+
test871 test872 test873 test874 test875 test876 test877 test878 test879 \
114+
test880 test881 test882 test883 test884 test885 test886 test887 test888 \
115+
test889 test890 test891 test892 test893 test894 test895 test896 test897 \
116+
test898 test899 test900 test901 test902 test903 test904 test905 test906 \
117+
test907 test908 test909 test910 test911 test912 test913 test914 test915 \
118+
test916 test917 test918 test919 test920 test921 test922 test923 test924 \
119+
test925 test926 test927 test928 test929 test930 test931 test932 test933 \
120+
test934 test935 test936 test937 test938 test939 test940 test941 test942 \
121+
test943 test944 test945 test946 test947 test948 test949 test950 test951 \
122+
test952 test953 test954 test955 test956 test957 test958 test959 test960 \
123+
test961 test962 test963 test964 test965 test966 test967 test968 test969 \
124+
test970 test971 test972 test973 test974 test975 test976 test977 test978 \
127125
\
128126
test980 test981 test982 test983 test984 test985 test986 test987 test988 \
129127
test989 \

‎tests/data/test899

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
<testcase>
2+
<info>
3+
<keywords>
4+
HTTP
5+
HTTP GET
6+
Basic
7+
</keywords>
8+
</info>
9+
10+
#
11+
# Server-side
12+
<reply>
13+
<data crlf="yes" nocheck="yes">
14+
HTTP/1.1 302 go go go
15+
Content-Length: 8
16+
Location: http://user:pass@%HOSTIP:%HTTPPORT/basic-auth/user/%TESTNUMBER0002
17+
Content-Type: text/html
18+
Funny-head: yesyes
19+
20+
notreal
21+
</data>
22+
<data2 crlf="yes">
23+
HTTP/1.1 200 OK
24+
Content-Length: 6
25+
Content-Type: text/html
26+
Funny-head: yesyes
27+
28+
final
29+
</data2>
30+
</reply>
31+
32+
#
33+
# Client-side
34+
<client>
35+
<server>
36+
http
37+
</server>
38+
<name>
39+
URL with credentials redirects to URL with different credentials
40+
</name>
41+
<command>
42+
http://first:secret@%HOSTIP:%HTTPPORT/%TESTNUMBER -L
43+
</command>
44+
</client>
45+
46+
#
47+
# Verify data after the test has been "shot"
48+
<verify>
49+
<protocol crlf="yes">
50+
GET /%TESTNUMBER HTTP/1.1
51+
Host: %HOSTIP:%HTTPPORT
52+
Authorization: Basic Zmlyc3Q6c2VjcmV0
53+
User-Agent: curl/%VERSION
54+
Accept: */*
55+
56+
GET /basic-auth/user/%TESTNUMBER0002 HTTP/1.1
57+
Host: %HOSTIP:%HTTPPORT
58+
Authorization: Basic dXNlcjpwYXNz
59+
User-Agent: curl/%VERSION
60+
Accept: */*
61+
62+
</protocol>
63+
</verify>
64+
</testcase>

0 commit comments

Comments
 (0)