Commit 9030bb0

committed

Fixed GH-18458: Authorization set with CURLOPT_USERPWD with NULL value.

1 parent 7869af6 commit 9030bb0Copy full SHA for 9030bb0

File tree

+38

-1

lines changed

+38

-1

lines changed

Lines changed: 17 additions & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -1900,7 +1900,6 @@ static zend_result _php_curl_setopt(php_curl ch, zend_long option, zval zvalue`
`1900`	`1900`	`case CURLOPT_SSLKEYTYPE:`
`1901`	`1901`	`case CURLOPT_SSL_CIPHER_LIST:`
`1902`	`1902`	`case CURLOPT_USERAGENT:`
`1903`		`- case CURLOPT_USERPWD:`
`1904`	`1903`	`case CURLOPT_COOKIELIST:`
`1905`	`1904`	`case CURLOPT_FTP_ALTERNATIVE_TO_USER:`
`1906`	`1905`	`case CURLOPT_SSH_HOST_PUBLIC_KEY_MD5:`
`@@ -1998,6 +1997,23 @@ static zend_result _php_curl_setopt(php_curl ch, zend_long option, zval zvalue`
`1998`	`1997`	`return ret;`
`1999`	`1998`	`}`
`2000`	`1999`
	`2000`	`+ case CURLOPT_USERPWD:`
	`2001`	`+ {`
	`2002`	`+ if (Z_ISNULL_P(zvalue)) {`
	`2003`	`+ // Authorization header would be implictly set`
	`2004`	`+ // with an empty string thus we explictly set the option`
	`2005`	`+ // to null to avoid this unwarranted side effect`
	`2006`	`+ error = curl_easy_setopt(ch->cp, option, NULL);`
	`2007`	`+ } else {`
	`2008`	`+ zend_string *tmp_str;`
	`2009`	`+ zend_string *str = zval_get_tmp_string(zvalue, &tmp_str);`
	`2010`	`+ zend_result ret = php_curl_option_str(ch, option, ZSTR_VAL(str), ZSTR_LEN(str));`
	`2011`	`+ zend_tmp_string_release(tmp_str);`
	`2012`	`+ return ret;`
	`2013`	`+ }`
	`2014`	`+ break;`
	`2015`	`+ }`
	`2016`	`+`
`2001`	`2017`	`/* Curl nullable string options */`
`2002`	`2018`	`case CURLOPT_CUSTOMREQUEST:`
`2003`	`2019`	`case CURLOPT_FTPPORT:`

Lines changed: 21 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,21 @@`
	`1`	`+--TEST--`
	`2`	`+GH-18458 authorization header is set despite CURLOPT_USERPWD set to null`
	`3`	`+--EXTENSIONS--`
	`4`	`+curl`
	`5`	`+--SKIPIF--`
	`6`	`+<?php`
	`7`	`+include 'skipif-nocaddy.inc';`
	`8`	`+?>`
	`9`	`+--FILE--`
	`10`	`+<?php`
	`11`	`+`
	`12`	`+$ch = curl_init("https://localhost/userpwd");`
	`13`	`+curl_setopt($ch, CURLOPT_USERPWD, null);`
	`14`	`+curl_setopt($ch, CURLOPT_VERBOSE, true);`
	`15`	`+curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);`
	`16`	`+$response = curl_exec($ch);`
	`17`	`+var_dump(str_contains($response, "authorization"));`
	`18`	`+?>`
	`19`	`+--EXPECT--`
	`20`	`+%A`
	`21`	`+bool(false)`

Comments

(0)