summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* strdup: name it Curl_strdupDaniel Stenberg2022-12-223-3/+3
| | | | | | | It does not belong in the curlx_ name space as it is never used externally. Closes #10132
* msh3: update to v0.5 ReleaseNick Banks2022-12-223-6/+19
| | | | Closes #10125
* workflows/linux.yml: merge 3 common packagesandy59952022-12-221-16/+15
| | | | Closes #10071
* docs: mention indirect effects of --insecureDaniel Stenberg2022-12-213-0/+21
| | | | | | | | Warn users that disabling certficate verification allows servers to "pollute" curl with data it trusts. Reported-by: Harry Sintonen Closes #10126
* SECURITY-PROCESS.md: document severity levelsDaniel Stenberg2022-12-211-0/+44
| | | | Closes #10118
* RELEASE_NOTES: syncedDaniel Stenberg2022-12-212-341/+10
| | | | bumped version for new cycle
* tool_operate: fix `CURLOPT_SOCKS5_GSSAPI_NEC` typeMarcel Raad2022-12-211-2/+1
| | | | | | | `CURLOPT_SOCKS5_GSSAPI_NEC` is a long, while `socks5_gssapi_nec` was made a bool in commit 4ac64eadf60. Closes https://github.com/curl/curl/pull/10124
* RELEASE-NOTES: syncedcurl-7_87_0Daniel Stenberg2022-12-211-18/+34
| | | | The curl 7.87.0 release
* THANKS: 40 new contributors from 7.87.0Daniel Stenberg2022-12-211-0/+40
|
* http: fix the ::1 comparison for IPv6 localhost for cookiesDaniel Stenberg2022-12-201-2/+2
| | | | | | | | | | | When checking if there is a "secure context", which it is if the connection is to localhost even if the protocol is HTTP, the comparison for ::1 was done incorrectly and included brackets. Reported-by: BratSinot on github Fixes #10120 Closes #10121
* CI/spell: actions/checkout@v2 > actions/checkout@v3Philip H2022-12-191-1/+1
|
* smb/telnet: do not free the protocol struct in *_done()Daniel Stenberg2022-12-192-15/+2
| | | | | | | | It is managed by the generic layer. Reported-by: Trail of Bits Closes #10112
* http: use the IDN decoded name in HSTS checksDaniel Stenberg2022-12-191-1/+1
| | | | | | | | | | Otherwise it stores the info HSTS into the persistent cache for the IDN name which will not match when the HSTS status is later checked for using the decoded name. Reported-by: Hiroki Kurosawa Closes #10111
* CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw"Daniel Stenberg2022-12-161-1/+4
| | | | Closes #10106
* socks: fix username max size is 255 (0xFF)Xì Gà2022-12-161-1/+1
| | | | | | Closes #10105 Reviewed-by: Daniel Gustafsson
* limit-rate.d: see also --rateDaniel Stenberg2022-12-161-1/+1
|
* lib1560: add some basic IDN host name testsDaniel Stenberg2022-12-151-0/+19
| | | | Closes #10094
* idn: rename the files to idn.[ch] and hold all IDN functionsDaniel Stenberg2022-12-157-221/+220
| | | | Closes #10094
* idn: remove Curl_win32_ascii_to_idnDaniel Stenberg2022-12-153-32/+34
| | | | | | It was not used. Introduce a new IDN header for the prototype(s). Closes #10094
* RELEASE-NOTES: syncedDaniel Stenberg2022-12-151-3/+29
|
* curl_url_get.3: remove spurious backtickDaniel Stenberg2022-12-151-1/+1
| | | | | | | | Put there by mistake. Follow-up from 9a8564a92 Closes #10101
* socks: fix infof() flag for outputing a charDaniel Stenberg2022-12-151-1/+1
| | | | | | | | | It used to be a 'long', %lu is no longer correct. Follow-up to 57d2d9b6bed33d Detected by Coverity CID 1517663 Closes #10100
* ssl-reqd.d: clarify that this is for upgrading connections onlyDaniel Stenberg2022-12-151-2/+6
| | | | Closes #10093
* curl_url_set.3: document CURLU_DISALLOW_USERDaniel Stenberg2022-12-151-0/+4
| | | | Closes #10099
* cmake: set the soname on the shared libraryDaniel Stenberg2022-12-154-22/+71
| | | | | | | | | Set SONAME and VERSION for platforms we think this works on. Remove issue from KNOWN_BUGS. Assisted-by: Jakub Zakrzewski Closes #10023
* tool_paramhlp: free the proto strings on exitDaniel Stenberg2022-12-152-0/+3
| | | | | | | | | And also make sure that repeated use of the options free the previous string before it stores a new. Follow-up from e6f8445edef8e7996d Closes #10098
* tool_cfgable: free the ssl_ec_curves on exitDaniel Stenberg2022-12-151-2/+1
| | | | | | Follow-up to ede125b7b Closes #10097
* urlapi: reject more bad letters from the host name: &+()Daniel Stenberg2022-12-152-5/+9
| | | | | | | | Follow-up from eb0167ff7d31d3a5 Extend test 1560 to verify Closes #10096
* altsvc: fix rejection of negative port numbersDaniel Stenberg2022-12-152-5/+12
| | | | | | | | | | | Follow-up to ac612dfeee95 strtoul() accepts a leading minus so better make sure there is none Extended test 356 somewhat to use a huge negative 64 bit number that otherwise becomes a low positive number. Closes #10095
* lib: use size_t or int etc instead of longsDaniel Stenberg2022-12-145-14/+14
| | | | | | | Since long is not using a consistent data size in curl builds, making it often "waste" 32 bits. Closes #10088
* azure: use "unversioned" clang and clang-tools for scanbuild jobDaniel Stenberg2022-12-141-6/+6
| | | | | | To make it less fragile Closes #10092
* x509asn1: avoid freeing unallocated pointersDaniel Gustafsson2022-12-141-9/+8
| | | | | | | | | | | When utf8asn1str fails there is no allocation returned, so freeing the return pointer in **to is at best a no-op and at worst a double- free bug waiting to happen. The current coding isn't hiding any such bugs but to future proof, avoid freeing the return value pointer iff the function failed. Closes: #10087 Reviewed-by: Daniel Stenberg <daniel@haxx.se>
* curl_url_set.3: fix typoEmil Engler2022-12-131-1/+1
| | | | | Closes: #10089 Reviewed-by: Daniel Gustafsson <daniel@yesql.se>
* test2304: verify websocket handling when connection is closedDaniel Stenberg2022-12-134-2/+200
|
* server/sws: if asked to close connection, skip the websocket handlingDaniel Stenberg2022-12-131-2/+6
|
* ws: if no connection is around, return errorDaniel Stenberg2022-12-132-6/+15
| | | | | | | | | | | - curl_ws_send returns CURLE_SEND_ERROR if data->conn is gone - curl_ws_recv returns CURLE_GOT_NOTHING on connection close - curl_ws_recv.3: mention new return code for connection close + example embryo Closes #10084
* docs: extend the dump-header documentationEmil Engler2022-12-131-0/+3
| | | | | | | | This commit extends the documentation of the --dump-header command-line option to reflect the behavior introduced in 8b1e5df7. See #10079 Closes #10085
* RELEASE-NOTES: syncedDaniel Stenberg2022-12-121-11/+41
|
* styled-output.d: this option does not work on WindowsDaniel Stenberg2022-12-121-0/+3
| | | | | | | Reported-by: u20221022 on github Fixes #10082 Closes #10083
* tool: determine the correct fopen option for -DEmil Engler2022-12-124-2/+98
| | | | | | | | | | | | This commit fixes a bug in the dump-header feature regarding the determination of the second fopen(3) option. Reported-by: u20221022 on github See #4753 See #4762 Fixes #10074 Closes #10079
* docs/curl_ws_send: Fixed typo in websocket docsMonkeybreadSoftware2022-12-111-2/+2
| | | | | | | Replace as with is in relevant sentences. Closes: #10081 Reviewed-by: Daniel Gustafsson <daniel@yesql.se>
* c-hyper: fix multi-request mechanismPrithvi MK2022-12-112-3/+16
| | | | | | | | It makes test 565 run fine. Fixes #8896 Closes #10080 Assisted-by: Daniel Stenberg
* page-header: grammar improvement (display transfer rate)andy59952022-12-111-3/+3
| | | | Closes #10068
* docs/DEPRECATE.md: grammar improvement and sp correctionandy59952022-12-111-2/+2
| | | | | | | The main thing I wanted to do was fix the spelling of "spent", but I think this rewording improves the flow of the paragraph. Closes #10067
* tool_cfgable: make socks5_gssapi_nec a booleanBoris Verkhovskiy2022-12-111-1/+1
| | | | Closes #10078
* contributors.sh: actually use $CURLWWW instead of just setting it.Frank Gevaerts2022-12-091-1/+1
| | | | | | | The script was all set up for flexibility where curl-www is elsewhere in the filesystem, but then hard-coded ../curl-www anyway... Closes #10064
* KNOWN_BUGS: remove items not considered bugs any moreDaniel Stenberg2022-12-095-137/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - CURL_GLOBAL_SSL This option was changed in libcurl 7.57.0 and clearly it has not caused too many issues and a lot of time has passed. - Store TLS context per transfer instead of per connection This is a possible future optimization. One that is much less important and interesting since the added support for CA caching. - Microsoft telnet server This bug was filed in May 2007 against curl 7.16.1 and we have not received further reports. - active FTP over a SOCKS Actually, proxies in general is not working with active FTP mode. This is now added in proxy documentation. - DICT responses show the underlying protocol curl still does this, but since this is now an established behavior since forever we cannot change it easily and adding an option for it seems crazy as this protocol is not so little its not worth it. Let's just live with it. - Secure Transport disabling hostname validation also disables SNI This is an already documented restriction in Secure Transport. - CURLOPT_SEEKFUNCTION not called with CURLFORM_STREAM The curl_formadd() function is marked and documented as deprecated. No point in collecting bugs for it. It should not be used further. - STARTTRANSFER time is wrong for HTTP POSTs After close source code inspection I cannot see how this is true or that there is any special treatment for different HTTP methods. We also have not received many further reports on this, making me strongly suspect that this is no (longer an) issue. - multipart formposts file name encoding The once proposed RFC 5987-encoding is since RFC 7578 documented as MUST NOT be used. The since then implemented MIME API allows the user to set the name on their own and can thus provide it encoded as it wants. - DoH is not used for all name resolves when enabled It is questionable if users actually want to use DoH for interface and FTP port name resolving. This restriction is now documented and we advice users against using name resolving at all for these functions. Closes #10043
* CURLOPT_COOKIEFILE.3: advice => adviseDaniel Stenberg2022-12-091-1/+1
| | | | | | Closes #10063 Reviewed-by: Daniel Gustafsson
* curl.h: reword comment to not use deprecated optionDaniel Gustafsson2022-12-091-1/+1
| | | | | | | | | CURLOPT_INFILE was replaced by CURLOPT_READDATA in 7.9.7, reword the comment mentioning it to make code grepping easier as well as improve the documentation. Closes: #10062 Reviewed-by: Daniel Stenberg <daniel@haxx.se>
* system.h: fix socklen_t, curl_off_t, long long for Classic Mac OSRyan Schmidt2022-12-092-7/+27
| | | | | | | | | | | | | | | | | | Change "__MWERKS__" to "macintosh". When this block was originally added in 3ac6929 it was probably intended to handle classic Mac OS since the previous classic Mac OS build procedure for curl (which was removed in bf327a9) used Metrowerks CodeWarrior. But there are other classic Mac OS compilers, such as the MPW compilers, that were not handled by this case. For classic Mac OS, CURL_TYPEOF_CURL_SOCKLEN_T needs to match what's provided by the third-party GUSI library, which does not vary by compiler. Meanwhile CodeWarrior works on platforms other than classic Mac OS, and they may need different definitions. Separate blocks could be added later for any of those platforms that curl doesn't already support. Closes #10049
View Lorry Controller Status