luo980/curl
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

digest: reject broken header with session protocol but without qop

Browse Source 
Closes #9077
This commit is contained in:
Evgeny Grin (Karlson2k) 2022-06-30 18:30:21 +03:00 committed by Daniel Stenberg
parent b6dd849fa3
commit 3fe24ea322
No known key found for this signature in database
GPG Key ID: 5CC908FDB71E12C2
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
lib/vauth/digest.c
View File

@ -637,6 +637,10 @@ CURLcode Curl_auth_decode_digest_http_message(const char *chlg,
if(!digest->nonce)
return CURLE_BAD_CONTENT_ENCODING;
/* "<algo>-sess" protocol versions require "auth" or "auth-int" qop */
if(!digest->qop && (digest->algo & SESSION_ALGO))
return CURLE_BAD_CONTENT_ENCODING;
return CURLE_OK;
}