@matheusbsbs / matheus-bagliano / commits / 4f5822076f

http.c: cookie file tightening

The http.cookiefile configuration variable is used to call curl_easy_setopt() to set CURLOPT_COOKIEFILE and if http.savecookies is set, the same value is used for CURLOPT_COOKIEJAR. The former is used only to read cookies at startup, the latter is used to write cookies at the end. The manual pages https://curl.se/libcurl/c/CURLOPT_COOKIEFILE.html and https://curl.se/libcurl/c/CURLOPT_COOKIEJAR.html talk about two interesting special values. * "" (an empty string) given to CURLOPT_COOKIEFILE means not to read cookies from any file upon startup. * It is not specified what "" (an empty string) given to CURLOPT_COOKIEJAR does; presumably open a file whose name is an empty string and write cookies to it? In any case, that is not what we want to see happen, ever. * "-" (a dash) given to CURLOPT_COOKIEFILE makes cURL read cookies from the standard input, and given to CURLOPT_COOKIEJAR makes cURL write cookies to the standard output. Neither of which we want ever to happen. So, let's make sure we avoid these nonsense cases. Specifically, when http.cookies is set to "-", ignore it with a warning, and when it is set to "" and http.savecookies is set, ignore http.savecookies with a warning. Signed-off-by: Junio C Hamano <gitster@pobox.com>

Junio C Hamano committed Jul 9, 2024 at 16:03 UTC 4f5822076f41d13258f82bd2ff7bde2630a611a0

1 file changed +9

http.c

@@ -1316,7 +1316,16 @@ struct active_request_slot *get_active_slot(void)

1316 slot->finished = NULL;

1317 slot->callback_data = NULL;

1318 slot->callback_func = NULL;

1319 +

1320 + if (curl_cookie_file && !strcmp(curl_cookie_file, "-")) {

1321 + warning(_("refusing to read cookies from http.cookiefile '-'"));

1322 + FREE_AND_NULL(curl_cookie_file);

1323 + }

1324 curl_easy_setopt(slot->curl, CURLOPT_COOKIEFILE, curl_cookie_file);

1325 + if (curl_save_cookies && (!curl_cookie_file || !curl_cookie_file[0])) {

1326 + curl_save_cookies = 0;

1327 + warning(_("ignoring http.savecookies for empty http.cookiefile"));

1328 + }

1329 if (curl_save_cookies)

1330 curl_easy_setopt(slot->curl, CURLOPT_COOKIEJAR, curl_cookie_file);

1331 curl_easy_setopt(slot->curl, CURLOPT_HTTPHEADER, pragma_header);