curl_sasl: if redirected, require permission to use bearer

[bagder]

No description provided.

[bagder]

augment review

[augmentcode]

Review completed. 2 suggestions posted.

Comment augment review to trigger a new review at any time.

[Copilot]

Pull request overview

This pull request implements a security enhancement to prevent OAuth bearer tokens from being automatically sent during HTTP redirects. The change ensures that bearer tokens used in SASL authentication (OAUTHBEARER and XOAUTH2) require explicit permission via CURLOPT_UNRESTRICTED_AUTH to be sent when following redirects, protecting against accidental token leakage to different hosts.

Key changes:

• Modified sasl_choose_oauth() and sasl_choose_oauth2() to check redirect status and authorization settings before using bearer tokens
• Bearer tokens are now set to NULL during redirects unless allow_auth_to_other_hosts is explicitly enabled
• Added comprehensive test coverage demonstrating the new security behavior

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
lib/curl_sasl.c	Added redirect check for OAuth bearer tokens in sasl_choose_oauth() and sasl_choose_oauth2() functions to prevent bearer tokens from being sent on redirects unless explicitly allowed
tests/data/test778	Test for HTTP OAuth2 bearer redirect to different host (bearer not passed to redirected host)
tests/data/test779	Test for HTTP OAuth2 bearer redirect to IMAP protocol (authentication fails with error 67 when bearer not sent)
tests/data/test795	Test for HTTP basic auth redirect to IMAP (demonstrates basic auth continues to work, showing OAuth bearer is more restrictive)
tests/data/Makefile.am	Added test778, test779, and test795 to the test suite in correct numerical sequence

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.