Daniel Stenberg bfe9b59be4 cookie: reject cookie names or content with TAB characters ... TABs in name and content seem allowed by RFC 6265: "the algorithm strips leading and trailing whitespace from the cookie name and value (but maintains internal whitespace)" Cookies with TABs in the names are rejected by Firefox and Chrome. TABs in content are stripped out by Firefox, while Chrome discards the whole cookie. TABs in cookies also cause issues in saved netscape cookie files. Reported-by: Trail of Bits URL: https://curl.se/mail/lib-2022-10/0032.html URL: https://github.com/httpwg/http-extensions/issues/2262 Closes #9659		2022-10-14 08:22:10 +02:00
..
vauth	strcase: add and use Curl_timestrcmp	2022-10-08 11:50:47 +02:00
vquic	ngtcp2: fix C89 compliance nit	2022-09-27 14:02:27 +02:00
vssh	tidy-up: delete parallel/unused feature flags	2022-10-06 15:30:13 +00:00
vtls	schannel: when importing PFX, disable key persistence	2022-10-11 04:04:54 -04:00
.checksrc
.gitattributes
.gitignore
altsvc.c	altsvc: reject bad port numbers	2022-09-28 12:44:37 +02:00
altsvc.h
amigaos.c
amigaos.h
arpa_telnet.h
asyn-ares.c	asyn-ares: set hint flags when calling ares_getaddrinfo	2022-10-11 08:23:33 +02:00
asyn-thread.c	hostip: lazily wait to figure out if IPv6 works until needed	2022-09-22 09:47:59 +02:00
asyn.h	lib: the number four in a sequence is the "fourth"	2022-09-19 08:48:49 +02:00
base64.c	misc: nitpick grammar in comments/docs	2022-10-12 11:32:43 +02:00
bufref.c
bufref.h
c-hyper.c
c-hyper.h
CMakeLists.txt	cmake: define BUILDING_LIBCURL in lib/CMakeLists, not config.h	2022-09-14 08:06:41 +02:00
config-amigaos.h	tidy-up: delete parallel/unused feature flags	2022-10-06 15:30:13 +00:00
config-dos.h	tidy-up: delete parallel/unused feature flags	2022-10-06 15:30:13 +00:00
config-mac.h
config-os400.h
config-plan9.h	tidy-up: delete parallel/unused feature flags	2022-10-06 15:30:13 +00:00
config-riscos.h
config-win32.h	lib: set more flags in config-win32.h	2022-10-13 15:43:31 +00:00
config-win32ce.h
conncache.c
conncache.h
connect.c	connect: fix Curl_updateconninfo for TRNSPRT_UNIX	2022-10-08 11:45:20 +02:00
connect.h
content_encoding.c	tidy-up: delete parallel/unused feature flags	2022-10-06 15:30:13 +00:00
content_encoding.h
cookie.c	cookie: reject cookie names or content with TAB characters	2022-10-14 08:22:10 +02:00
cookie.h
curl_addrinfo.c	misc: null-terminate	2022-09-17 23:19:29 +02:00
curl_addrinfo.h
curl_base64.h
curl_config.h.cmake	cmake: add the check of HAVE_SOCKETPAIR	2022-10-10 23:23:22 +02:00
curl_ctype.h
curl_des.c	docs: update sourceforge project links [ci skip]	2022-10-01 18:40:47 +00:00
curl_des.h
curl_endian.c
curl_endian.h
curl_fnmatch.c
curl_fnmatch.h
curl_get_line.c
curl_get_line.h
curl_gethostname.c
curl_gethostname.h
curl_gssapi.c
curl_gssapi.h
curl_hmac.h
curl_krb5.h
curl_ldap.h
curl_md4.h
curl_md5.h
curl_memory.h
curl_memrchr.c
curl_memrchr.h
curl_multibyte.c
curl_multibyte.h
curl_ntlm_core.c	docs: update sourceforge project links [ci skip]	2022-10-01 18:40:47 +00:00
curl_ntlm_core.h
curl_ntlm_wb.c	docs: update sourceforge project links [ci skip]	2022-10-01 18:40:47 +00:00
curl_ntlm_wb.h
curl_path.c
curl_path.h
curl_printf.h
curl_range.c
curl_range.h
curl_rtmp.c
curl_rtmp.h
curl_sasl.c
curl_sasl.h
curl_setup_once.h	functypes: provide the recv and send arg and return types	2022-09-28 09:06:11 +02:00
curl_setup.h	docs: spelling nits	2022-09-29 21:29:04 +00:00
curl_sha256.h
curl_sspi.c
curl_sspi.h
curl_threads.c
curl_threads.h
curlx.h
dict.c
dict.h
doh.c	hostip: lazily wait to figure out if IPv6 works until needed	2022-09-22 09:47:59 +02:00
doh.h
dynbuf.c
dynbuf.h	misc: null-terminate	2022-09-17 23:19:29 +02:00
easy_lock.h
easy.c	easy: avoid Intel error #2312: pointer cast involving 64-bit pointed-to type	2022-10-07 18:32:07 +02:00
easygetopt.c
easyif.h	websockets: remodeled API to support 63 bit frame sizes	2022-10-07 12:50:58 +02:00
easyoptions.c
easyoptions.h
escape.c
escape.h
file.c
file.h
fileinfo.c
fileinfo.h
fopen.c
fopen.h
formdata.c	formdata: typecast the va_arg return value	2022-09-13 15:38:48 +02:00
formdata.h
ftp.c
ftp.h
ftplistparser.c
ftplistparser.h
functypes.h	functypes: provide the recv and send arg and return types	2022-09-28 09:06:11 +02:00
getenv.c
getinfo.c
getinfo.h
gopher.c
gopher.h
h2h3.c
h2h3.h
hash.c
hash.h
headers.c	misc: null-terminate	2022-09-17 23:19:29 +02:00
headers.h
hmac.c
hostasyn.c
hostip4.c
hostip6.c	hostip: lazily wait to figure out if IPv6 works until needed	2022-09-22 09:47:59 +02:00
hostip.c	hostip: lazily wait to figure out if IPv6 works until needed	2022-09-22 09:47:59 +02:00
hostip.h
hostsyn.c
hsts.c
hsts.h
http2.c
http2.h
http_aws_sigv4.c	http_aws_sigv4: fix strlen() check	2022-10-13 09:04:54 +02:00
http_aws_sigv4.h
http_chunks.c
http_chunks.h
http_digest.c
http_digest.h
http_negotiate.c
http_negotiate.h
http_ntlm.c	docs: update sourceforge project links [ci skip]	2022-10-01 18:40:47 +00:00
http_ntlm.h
http_proxy.c
http_proxy.h
http.c	url: allow non-HTTPS HSTS-matching for debug builds	2022-10-13 23:28:43 +02:00
http.h	websockets: remodeled API to support 63 bit frame sizes	2022-10-07 12:50:58 +02:00
idn_win32.c	windows: adjust name of two internal public functions	2022-09-26 22:32:23 +00:00
if2ip.c
if2ip.h
imap.c
imap.h
inet_ntop.c
inet_ntop.h
inet_pton.c
inet_pton.h
krb5.c
ldap.c
libcurl.plist.in
libcurl.rc
libcurl.vers.in
llist.c
llist.h
Makefile.am	windows: add .rc support to autotools builds	2022-09-18 12:05:35 +00:00
makefile.amiga
makefile.dj
Makefile.inc	functypes: provide the recv and send arg and return types	2022-09-28 09:06:11 +02:00
Makefile.m32	Makefile.m32: drop CROSSPREFIX and our CC/AR defaults [ci skip]	2022-10-11 21:16:00 +00:00
md4.c
md5.c
memdebug.c
memdebug.h	functypes: provide the recv and send arg and return types	2022-09-28 09:06:11 +02:00
mime.c	lib: sanitize conditional exclusion around MIME	2022-09-29 10:51:04 +02:00
mime.h	lib: sanitize conditional exclusion around MIME	2022-09-29 10:51:04 +02:00
mprintf.c	mprintf: use snprintf if available	2022-09-22 23:06:26 +02:00
mqtt.c
mqtt.h
multi.c	hostip: lazily wait to figure out if IPv6 works until needed	2022-09-22 09:47:59 +02:00
multihandle.h	hostip: lazily wait to figure out if IPv6 works until needed	2022-09-22 09:47:59 +02:00
multiif.h
netrc.c	netrc: remove the two 'changed' arguments	2022-10-13 23:42:07 +02:00
netrc.h	netrc: remove the two 'changed' arguments	2022-10-13 23:42:07 +02:00
nonblock.c
nonblock.h
openldap.c
optiontable.pl
parsedate.c
parsedate.h
pingpong.c
pingpong.h
pop3.c
pop3.h
progress.c
progress.h
psl.c
psl.h
quic.h
rand.c	misc: null-terminate	2022-09-17 23:19:29 +02:00
rand.h	misc: null-terminate	2022-09-17 23:19:29 +02:00
rename.c
rename.h
rtsp.c
rtsp.h
select.c
select.h	tidy-up: delete unused HAVE_STRUCT_POLLFD	2022-10-12 14:19:09 +00:00
sendf.c	ws: minor fixes for web sockets without the CONNECT_ONLY flag	2022-10-09 23:09:58 +02:00
sendf.h
setopt.c	lib: sanitize conditional exclusion around MIME	2022-09-29 10:51:04 +02:00
setopt.h
setup-os400.h
setup-vms.h
setup-win32.h
sha256.c
share.c
share.h
sigpipe.h
slist.c
slist.h
smb.c	smb: replace CURL_WIN32 with WIN32	2022-10-11 21:05:44 +00:00
smb.h
smtp.c
smtp.h
sockaddr.h
socketpair.c
socketpair.h
socks_gssapi.c
socks_sspi.c
socks.c
socks.h
speedcheck.c
speedcheck.h
splay.c
splay.h
strcase.c	strcase: add and use Curl_timestrcmp	2022-10-08 11:50:47 +02:00
strcase.h	strcase: add and use Curl_timestrcmp	2022-10-08 11:50:47 +02:00
strdup.c
strdup.h
strerror.c	strerror: improve two URL API error messages	2022-09-15 09:31:29 +02:00
strerror.h
strtok.c
strtok.h
strtoofft.c
strtoofft.h
system_win32.c
system_win32.h
telnet.c
telnet.h
tftp.c
tftp.h
timediff.c	lib: add missing limits.h includes	2022-09-12 09:41:50 +02:00
timediff.h
timeval.c
timeval.h
transfer.c	setopt: use the handler table for protocol name to number conversions	2022-09-16 23:29:01 +02:00
transfer.h
url.c	netrc: remove the two 'changed' arguments	2022-10-13 23:42:07 +02:00
url.h	setopt: use the handler table for protocol name to number conversions	2022-09-16 23:29:01 +02:00
urlapi-int.h	urlapi: detect scheme better when not guessing	2022-09-15 09:31:40 +02:00
urlapi.c	misc: nitpick grammar in comments/docs	2022-10-12 11:32:43 +02:00
urldata.h	tidy-up: delete parallel/unused feature flags	2022-10-06 15:30:13 +00:00
version_win32.c
version_win32.h
version.c	tidy-up: delete parallel/unused feature flags	2022-10-06 15:30:13 +00:00
warnless.c	lib: add missing limits.h includes	2022-09-12 09:41:50 +02:00
warnless.h
wildcard.c
wildcard.h
ws.c	ws: fix buffer pointer use in the callback loop	2022-10-10 11:21:56 +02:00
ws.h	websockets: remodeled API to support 63 bit frame sizes	2022-10-07 12:50:58 +02:00