hsts: make the HSTS read callback handle name dupes

[bagder]

Now the logic for handling name duplicates and picking the longest expiry and strictest subdomain is the same for the callback as for when reading from file.

Also strip trailing dots from the hostname added by the callback.

A minor side-effect is that the hostname provided by the callback can now enable subdomains by starting the name with a dot, but we discourage using such hostnames in documentation.

Amended test 1915 to verify.

[Copilot]

Pull request overview

This PR aligns HSTS entry de-duplication behavior between HSTS file loading and the CURLOPT_HSTSREADFUNCTION callback path, ensuring consistent selection of the longest expiry and strictest includeSubDomains policy, while normalizing hostnames from the callback.

Changes:

• Refactors shared “add HSTS host + expiry” logic into a helper used by both file parsing and callback ingestion.
• Normalizes callback-provided hostnames by stripping trailing dots and interpreting a leading dot as enabling includeSubDomains.
• Updates test 1915 to validate duplicate handling, subdomain strictness, and trailing-dot stripping.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
lib/hsts.c	Introduces shared add/update helper and uses it for both file parsing and callback loading, including hostname normalization and duplicate merge rules.
tests/libtest/lib1915.c	Extends callback-fed preload list to include dupes/trailing-dot/leading-dot cases and prints includeSubDomains in output.
tests/data/test1915	Updates expected stdout to reflect merged entries (strictest subdomain + longest expiry).
docs/libcurl/opts/CURLOPT_HSTSREADFUNCTION.md	Clarifies guidance around leading/trailing dots in callback-provided hostnames.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[aisle-research-bot]

🔒 Aisle Security Analysis

✅ We scanned this PR and did not find any security vulnerabilities.

_{Aisle supplements but does not replace security review.}

---

Analyzed PR: #21201 at commit 862ae98

_{Last updated on: 2026-04-02T11:37:13Z}

[aisle-research-bot]

🤖 We're reviewing this PR with Aisle

We're running a security check on the changes in this PR now. This usually takes a few minutes. ⌛
We'll post the results here as soon as they're ready.

Progress:

• Analysis
• Finalization

Latest run failed. Keeping previous successful results. Trace ID: 019d4dfa7c3a3cee7725e41a0172bb2b.

_{Last updated on: 2026-04-02T12:33:10Z}