cookie: check __Secure- and __Host- case sensitively when read from file

[alhudz]

Repro: load a cookie file holding __secure-x (lower case, no Secure) and the name is dropped, while the identical __secure-x received over a Set-Cookie header is kept as an ordinary cookie. test2311 covers it.

Cause: parse_netscape() detected the __Secure-/__Host- name prefixes with case-insensitive curl_strnequal(), but the header path uses case-sensitive strncmp() and the 6265bis document specifies a case-sensitive match (the reason 5af0165 switched the header path). So on the file path a differently cased name was wrongly put through the prefix integrity checks.

Fix: use strncmp() on the file path too, so both paths match the prefixes case sensitively and agree with the spec. A correctly cased __Secure-/__Host- is still enforced.

Earlier I had this the other way round (making the header path case insensitive); that was wrong, the spec wants case-sensitive. Folded the coverage into test 2311 instead of a new file.

[vszakats]

Would it be possible to merge this test case into the recently added test 2311?

[bagder]

This is incorrect. See 5af0165 which made the exact opposite change for cookie spec reasons!

[bagder]

I think the fix should rather be to make sure file content is also parsed case sensitively.

[alhudz]

You're right, the spec wants a case-sensitive match and the header path already does that since 5af0165. I had it backwards.

Flipped it round: the file path now uses strncmp() too, so __secure-x loaded from a file is kept as an ordinary cookie and a correctly cased __Secure-/__Host- is still put through the integrity checks. Folded the case into test 2311 as you suggested and dropped the separate 2312.

[testclutch]

Analysis of PR #22085 at 31f64c25:

Test ../../tests/http/test_07_upload.py::TestUpload::test_07_31_put_10m[h3] failed, which has NOT been flaky recently, so there could be a real issue in this PR. Note that this test has failed in 2 different CI jobs (the link just goes to one of them).

Generated by Testclutch

[bagder]

Thanks!