luo980/curl
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

url: use IDN decoded names for HSTS checks

Browse Source 
Reported-by: Hiroki Kurosawa

Closes #9791
This commit is contained in:
Daniel Stenberg 2022-10-12 10:47:59 +02:00
parent 809c81b9f5
commit 53bcf55b45
No known key found for this signature in database
GPG Key ID: 5CC908FDB71E12C2
1 changed files with 47 additions and 44 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

91
lib/url.c
View File

@ -2036,10 +2036,56 @@ static CURLcode parseurlandfillconn(struct Curl_easy *data,
failf(data, "Too long host name (maximum is %d)", MAX_URL_LEN);
return CURLE_URL_MALFORMAT;
}
hostname = data->state.up.hostname;
if(hostname && hostname[0] == '[') {
/* This looks like an IPv6 address literal. See if there is an address
scope. */
size_t hlen;
conn->bits.ipv6_ip = TRUE;
/* cut off the brackets! */
hostname++;
hlen = strlen(hostname);
hostname[hlen - 1] = 0;
zonefrom_url(uh, data, conn);
}
/* make sure the connect struct gets its own copy of the host name */
conn->host.rawalloc = strdup(hostname ? hostname : "");
if(!conn->host.rawalloc)
return CURLE_OUT_OF_MEMORY;
conn->host.name = conn->host.rawalloc;
/*************************************************************
* IDN-convert the hostnames
*************************************************************/
result = Curl_idnconvert_hostname(data, &conn->host);
if(result)
return result;
if(conn->bits.conn_to_host) {
result = Curl_idnconvert_hostname(data, &conn->conn_to_host);
if(result)
return result;
}
#ifndef CURL_DISABLE_PROXY
if(conn->bits.httpproxy) {
result = Curl_idnconvert_hostname(data, &conn->http_proxy.host);
if(result)
return result;
}
if(conn->bits.socksproxy) {
result = Curl_idnconvert_hostname(data, &conn->socks_proxy.host);
if(result)
return result;
}
#endif
#ifndef CURL_DISABLE_HSTS
/* HSTS upgrade */
if(data->hsts && strcasecompare("http", data->state.up.scheme)) {
if(Curl_hsts(data->hsts, data->state.up.hostname, TRUE)) {
/* This MUST use the IDN decoded name */
if(Curl_hsts(data->hsts, conn->host.name, TRUE)) {
char *url;
Curl_safefree(data->state.up.scheme);
uc = curl_url_set(uh, CURLUPART_SCHEME, "https", 0);
@ -2145,26 +2191,6 @@ static CURLcode parseurlandfillconn(struct Curl_easy *data,
(void)curl_url_get(uh, CURLUPART_QUERY, &data->state.up.query, 0);
hostname = data->state.up.hostname;
if(hostname && hostname[0] == '[') {
/* This looks like an IPv6 address literal. See if there is an address
scope. */
size_t hlen;
conn->bits.ipv6_ip = TRUE;
/* cut off the brackets! */
hostname++;
hlen = strlen(hostname);
hostname[hlen - 1] = 0;
zonefrom_url(uh, data, conn);
}
/* make sure the connect struct gets its own copy of the host name */
conn->host.rawalloc = strdup(hostname ? hostname : "");
if(!conn->host.rawalloc)
return CURLE_OUT_OF_MEMORY;
conn->host.name = conn->host.rawalloc;
#ifdef ENABLE_IPV6
if(data->set.scope_id)
/* Override any scope that was set above. */
@ -3713,29 +3739,6 @@ static CURLcode create_conn(struct Curl_easy *data,
if(result)
goto out;
/*************************************************************
* IDN-convert the hostnames
*************************************************************/
result = Curl_idnconvert_hostname(data, &conn->host);
if(result)
goto out;
if(conn->bits.conn_to_host) {
result = Curl_idnconvert_hostname(data, &conn->conn_to_host);
if(result)
goto out;
}
#ifndef CURL_DISABLE_PROXY
if(conn->bits.httpproxy) {
result = Curl_idnconvert_hostname(data, &conn->http_proxy.host);
if(result)
goto out;
}
if(conn->bits.socksproxy) {
result = Curl_idnconvert_hostname(data, &conn->socks_proxy.host);
if(result)
goto out;
}
#endif
/*************************************************************
* Check whether the host and the "connect to host" are equal.