luo980/curl
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
A command line tool and library for transferring data with URL syntax, supporting DICT, FILE, FTP, FTPS, GOPHER, GOPHERS, HTTP, HTTPS, IMAP, IMAPS, LDAP, LDAPS, MQTT, POP3, POP3S, RTMP, RTMPS, RTSP, SCP, SFTP, SMB, SMBS, SMTP, SMTPS, TELNET, TFTP, WS and WSS. libcurl offers a myriad of powerful features
33,331 Commits 20 Branches 224 Tags 202 MiB
C 74.8%
Perl 8.1%
M4 4.8%
Python 4.3%
CMake 2.7%
Other 5.3%
22652a5a4c
Go to file
Viktor Szakats 22652a5a4c
curl: add options for safe/no CA bundle search (Windows) 
Add `CURL_CA_SEARCH_SAFE` build-time option to enable CA bundle search
in the `curl` tool directory. The lookup method was already used to find
`.curlrc` and `_curlrc` (on Windows). On Windows it overrides the unsafe
default `SearchPath()` method.

Enable with:
- cmake: `-DCURL_CA_SEARCH_SAFE=ON`
- autotools: `--enable-ca-search-safe`
- raw: `CPPFLAGS=-DCURL_CA_SEARCH_SAFE`

On Windows, before this patch the whole `PATH` was searched for
a CA bundle. `PATH` may contain unwanted or world-writable locations,
including the current directory. Searching them all is convenient to
pick up any CA bundle, but not secure.

The Muldersoft curl distro implements such CA search via a custom
patch for Windows:
cd652d4792/patch/curl_tool_doswin.diff (L50)

MSYS2/mingw-w64 distro has also been rolling a patch solving this:
https://github.com/msys2/MINGW-packages/blob/master/mingw-w64-curl/0001-Make-cURL-relocatable.patch
https://github.com/msys2/MINGW-packages/blob/master/mingw-w64-curl/pathtools.c

Also add option to fully disable Windows CA search:
- cmake: `-DCURL_DISABLE_CA_SEARCH=ON`
- autotools: `--disable-ca-search`
- raw: `CPPFLAGS=-DCURL_DISABLE_CA_SEARCH`.

Both options are considered EXPERIMENTAL, with possible incompatible
changes or even (partial) removal in the future, depending on feedback.

An alternative, secure option is to embed the CA bundle into the binary.

Safe search can be extended to other platforms if necessary or useful,
by using `_NSGetExecutablePath()` (macOS),
`/proc/self/exe` (Linux/Cygwin), or `argv[0]`.

Closes #14582
2024-09-22 18:17:25 +02:00
.circleci tests: speed up builds with single-binary test bundles 2024-09-22 09:51:15 +02:00
.github curl: add options for safe/no CA bundle search (Windows) 2024-09-22 18:17:25 +02:00
CMake cmake: tidy up 2024-09-22 09:51:15 +02:00
docs curl: add options for safe/no CA bundle search (Windows) 2024-09-22 18:17:25 +02:00
include build: tidy up deprecation suppression, enable warnings for clang 2024-09-21 00:59:52 +02:00
lib curl: add options for safe/no CA bundle search (Windows) 2024-09-22 18:17:25 +02:00
LICENSES copyright: update all copyright lines and remove year ranges 2023-01-03 09:19:21 +01:00
m4 tidy-up: indent, whitespace, #error in make files 2024-09-22 09:51:15 +02:00
packages lib/src: white space edits to comply better with code style 2024-09-19 14:59:12 +02:00
plan9 copyright: update all copyright lines and remove year ranges 2023-01-03 09:19:21 +01:00
projects misc: general C style cleanups 2024-08-22 23:43:45 +02:00
scripts tidy-up: indent, whitespace, #error in make files 2024-09-22 09:51:15 +02:00
src curl: add options for safe/no CA bundle search (Windows) 2024-09-22 18:17:25 +02:00
tests curl: add options for safe/no CA bundle search (Windows) 2024-09-22 18:17:25 +02:00
winbuild tidy-up: OS names 2024-08-04 19:17:45 +02:00
.dir-locals.el copyright: update all copyright lines and remove year ranges 2023-01-03 09:19:21 +01:00
.git-blame-ignore-revs copyright: update all copyright lines and remove year ranges 2023-01-03 09:19:21 +01:00
.gitattributes winbuild: MS-DOS batch tidy-ups 2024-07-02 19:26:15 +02:00
.gitignore build: buildinfo.txt improvements 2024-09-19 15:56:30 +02:00
.mailmap mailmap: Aki Sakurai 2024-08-30 10:28:34 +02:00
acinclude.m4 tidy-up: indent, whitespace, #error in make files 2024-09-22 09:51:15 +02:00
appveyor.sh tests: speed up builds with single-binary test bundles 2024-09-22 09:51:15 +02:00
appveyor.yml tests: speed up builds with single-binary test bundles 2024-09-22 09:51:15 +02:00
buildconf copyright: update all copyright lines and remove year ranges 2023-01-03 09:19:21 +01:00
buildconf.bat buildconf.bat: remove outdated groff/nroff use 2024-03-07 22:38:16 +01:00
CHANGES.md CHANGES: rename to CHANGES.md, no longer generated 2024-08-01 13:37:12 +02:00
CMakeLists.txt curl: add options for safe/no CA bundle search (Windows) 2024-09-22 18:17:25 +02:00
configure.ac curl: add options for safe/no CA bundle search (Windows) 2024-09-22 18:17:25 +02:00
COPYING COPYING: update copyright year 2024-01-08 18:40:06 +01:00
curl-config.in GHA/configure-vs-cmake: check libcurl.pc/curl-config, fix issues 2024-09-21 12:08:35 +02:00
Dockerfile maketgz: move from / into scripts 2024-09-05 17:07:41 +02:00
GIT-INFO.md GIT-INFO.md: remove version requirements 2024-07-08 23:06:05 +02:00
libcurl.pc.in GHA/configure-vs-cmake: check libcurl.pc/curl-config, fix issues 2024-09-21 12:08:35 +02:00
Makefile.am build: buildinfo.txt improvements 2024-09-19 15:56:30 +02:00
Makefile.dist Makefile.dist: fix ca-firefox target 2024-09-06 21:46:05 +02:00
README docs: minor grammar fixes 2022-09-29 10:44:12 +02:00
README.md README: refresh 2024-08-25 23:31:53 +02:00
RELEASE-NOTES RELEASE-NOTES: synced 2024-09-21 17:57:39 +02:00
renovate.json GHA: unify http3 workflows into one 2024-06-01 10:57:23 +02:00
REUSE.toml lib: enable strerror and strncpy checksrc warnings in subdirs 2024-09-09 16:51:21 +02:00
SECURITY.md docs: Clarify OpenSSF Best Practices vs Scorecard 2024-08-22 11:50:20 +02:00

README.md

curl logo

Curl is a command-line tool for transferring data specified with URL syntax. Learn how to use curl by reading the manpage or everything curl.

Find out how to install curl by reading the INSTALL document.

libcurl is the library curl is using to do its job. It is readily available to be used by your software. Read the libcurl manpage to learn how.

Open Source

curl is Open Source and is distributed under an MIT-like license.

Contact

Contact us on a suitable mailing list or use GitHub issues/ pull requests/ discussions.

All contributors to the project are listed in the THANKS document.

Commercial support

For commercial support, maybe private and dedicated help with your problems or applications using (lib)curl visit the support page.

Website

Visit the curl website for the latest news and downloads.

Source code

Download the latest source from the Git server:

git clone https://github.com/curl/curl.git

Security problems

Report suspected security problems via our HackerOne page and not in public.

Notice

Curl contains pieces of source code that is Copyright (c) 1998, 1999 Kungliga Tekniska Högskolan. This notice is included here to comply with the distribution terms.

Backers

Thank you to all our backers! 🙏 Become a backer.

Sponsors

Support this project by becoming a sponsor.