http: trim custom header name before the Authorization drop#22178
Closed
alhudz wants to merge 1 commit into
Closed
http: trim custom header name before the Authorization drop#22178alhudz wants to merge 1 commit into
alhudz wants to merge 1 commit into
Conversation
A custom header name padded with blanks (`Authorization :`) missed the exact-length compare and slipped past the cross-host Authorization and Cookie drop, forwarding the header to the redirect target. Trim the parsed name in both the request and proxy CONNECT header builders.
bagder
approved these changes
Jun 25, 2026
Member
|
Thanks! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Repro:
-x <proxy> -H "Authorization : s3cr3t" --locationagainst a URL that redirects to a different host forwards the header to the second host.Cause: the cross-host
Authorization/Cookiedrop matches the field name parsed up to the:, which keeps the blanks around it, so a padded name likeAuthorizationmisses the exact-length compare and the drop is skipped.Curl_add_custom_headersand the proxy CONNECT builderdynhds_add_customboth do this.Fix:
curlx_str_trimblanks()the parsed name before the compare in both builders, the same way the value is already trimmed.test2113covers it (fails before, passes after; modelled ontest317).