diff options
Diffstat (limited to 'lib/cookie.c')
| -rw-r--r-- | lib/cookie.c | 50 |
1 files changed, 29 insertions, 21 deletions
diff --git a/lib/cookie.c b/lib/cookie.c index 092a226..6b678ae 100644 --- a/lib/cookie.c +++ b/lib/cookie.c @@ -5,7 +5,7 @@ * | (__| |_| | _ <| |___ * \___|\___/|_| \_\_____| * - * Copyright (C) 1998 - 2016, Daniel Stenberg, <daniel@haxx.se>, et al. + * Copyright (C) 1998 - 2017, Daniel Stenberg, <daniel@haxx.se>, et al. * * This software is licensed as described in the file COPYING, which * you should have received as part of this distribution. The terms @@ -492,7 +492,6 @@ Curl_cookie_add(struct Curl_easy *data, } else if(strcasecompare("domain", name)) { bool is_ip; - const char *dotp; /* Now, we make sure that our host is within the given domain, or the given domain is not valid and thus cannot be set. */ @@ -500,12 +499,22 @@ Curl_cookie_add(struct Curl_easy *data, if('.' == whatptr[0]) whatptr++; /* ignore preceding dot */ - is_ip = isip(domain ? domain : whatptr); +#ifndef USE_LIBPSL + /* + * Without PSL we don't know when the incoming cookie is set on a + * TLD or otherwise "protected" suffix. To reduce risk, we require a + * dot OR the exact host name being "localhost". + */ + { + const char *dotp; + /* check for more dots */ + dotp = strchr(whatptr, '.'); + if(!dotp && !strcasecompare("localhost", whatptr)) + domain=":"; + } +#endif - /* check for more dots */ - dotp = strchr(whatptr, '.'); - if(!dotp) - domain=":"; + is_ip = isip(domain ? domain : whatptr); if(!domain || (is_ip && !strcmp(whatptr, domain)) @@ -920,9 +929,8 @@ static char *get_line(char *buf, int len, FILE *input) } return b; } - else - /* read a partial, discard the next piece that ends with newline */ - partial = TRUE; + /* read a partial, discard the next piece that ends with newline */ + partial = TRUE; } else break; @@ -1055,16 +1063,16 @@ static int cookie_sort(const void *p1, const void *p2) #define CLONE(field) \ do { \ if(src->field) { \ - dup->field = strdup(src->field); \ - if(!dup->field) \ + d->field = strdup(src->field); \ + if(!d->field) \ goto fail; \ } \ } while(0) static struct Cookie *dup_cookie(struct Cookie *src) { - struct Cookie *dup = calloc(sizeof(struct Cookie), 1); - if(dup) { + struct Cookie *d = calloc(sizeof(struct Cookie), 1); + if(d) { CLONE(expirestr); CLONE(domain); CLONE(path); @@ -1073,16 +1081,16 @@ static struct Cookie *dup_cookie(struct Cookie *src) CLONE(value); CLONE(maxage); CLONE(version); - dup->expires = src->expires; - dup->tailmatch = src->tailmatch; - dup->secure = src->secure; - dup->livecookie = src->livecookie; - dup->httponly = src->httponly; + d->expires = src->expires; + d->tailmatch = src->tailmatch; + d->secure = src->secure; + d->livecookie = src->livecookie; + d->httponly = src->httponly; } - return dup; + return d; fail: - freecookie(dup); + freecookie(d); return NULL; } |