summaryrefslogtreecommitdiff
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* tool_cb_wrt: fix outfile mode flags for WindowsJay Satiro2020-07-291-3/+6
| | | | | | | | | | | | | | | | - Use S_IREAD and S_IWRITE mode permission flags to create the file on Windows instead of S_IRUSR, S_IWUSR, etc. Windows only accepts a combination of S_IREAD and S_IWRITE. It does not acknowledge other combinations, for which it may generate an assertion. This is a follow-up to 81b4e99 from yesterday, which improved the existing file check with -J. Ref: https://docs.microsoft.com/en-us/cpp/c-runtime-library/reference/open-wopen#remarks Ref: https://github.com/curl/curl/pull/5731 Closes https://github.com/curl/curl/pull/5742
* checksrc: ban gmtime/localtimeDaniel Stenberg2020-07-281-1/+2
| | | | | | | | | They're not thread-safe so they should not be used in libcurl code. Explictly enabled when deemed necessary and in examples and tests Reviewed-by: Nicolas Sterchele Closes #5732
* curl: improve the existing file check with -JDaniel Stenberg2020-07-281-9/+22
| | | | | | | | | | Previously a file that isn't user-readable but is user-writable would not be properly avoided and would get overwritten. Reported-by: BrumBrum on hackerone Assisted-by: Jay Satiro Bug: https://hackerone.com/reports/926638 Closes #5731
* WIN32: stop forcing narrow-character APIMarcel Raad2020-07-274-11/+23
| | | | | | | | | | Except where the results are only used for character output. getenv is not touched because it's part of the public API, and having it return UTF-8 instead of ANSI would be a breaking change. Fixes https://github.com/curl/curl/issues/5658 Fixes https://github.com/curl/curl/issues/5712 Closes https://github.com/curl/curl/pull/5718
* util: silence conversion warningsMarcel Raad2020-07-191-1/+1
| | | | | | | | | | timeval::tv_usec might be a 32-bit integer and timespec::tv_nsec might be a 64-bit integer. This is the case when building for recent macOS versions, for example. Just treat tv_usec as an int, which should hopefully always be sufficient on systems with `HAVE_CLOCK_GETTIME_MONOTONIC`. Closes https://github.com/curl/curl/pull/5695
* strdup: remove the odd strlen checkDaniel Stenberg2020-07-181-9/+4
| | | | | | | It confuses code analyzers with its use of -1 for unsigned value. Also, a check that's not normally used in strdup() code - and not necessary. Closes #5697
* file2memory: use a define instead of -1 unsigned valueDaniel Stenberg2020-07-161-2/+2
| | | | | | | | | ... to use the maximum value for 'size_t' when detecting integer overflow. Changed the limit to max/4 as already that seems unreasonably large. Codacy didn't like the previous approach. Closes #5683
* curl: add %{method} to the -w variablesDaniel Stenberg2020-07-142-0/+10
| | | | | | Gets the CURLINFO_EFFECTIVE_METHOD from libcurl. Added test 1197 to verify.
* windows: add unicode to feature listViktor Szakats2020-07-141-0/+1
| | | | | | | Reviewed-by: Marcel Raad Reviewed-by: Marc Hörsken Closes #5491
* content_encoding: add zstd decoding supportGilles Vollant2020-07-123-2/+16
| | | | | | | | | include zstd curl patch for Makefile.m32 from vszakats and include Add CMake support for zstd from Peter Wu Helped-by: Viktor Szakats Helped-by: Peter Wu Closes #5453
* tool_getparam: make --krb option work againKamil Dudka2020-07-031-1/+1
| | | | | | | It was disabled by mistake in commit curl-7_37_1-23-ge38ba4301. Bug: https://bugzilla.redhat.com/1833193 Closes #5640
* terminology: call them null-terminated stringsDaniel Stenberg2020-06-284-8/+8
| | | | | | | | | | | Updated terminology in docs, comments and phrases to refer to C strings as "null-terminated". Done to unify with how most other C oriented docs refer of them and what users in general seem to prefer (based on a single highly unscientific poll on twitter). Reported-by: coinhubs on github Fixes #5598 Closes #5608
* tool_cb_hdr: Fix etag warning output and return codeJay Satiro2020-06-261-4/+4
| | | | | | | | | | - Return 'failure' on failure, to follow the existing style. - Put Warning: and the warning message on the same line. Ref: https://github.com/curl/curl/issues/5610 Closes https://github.com/curl/curl/pull/5612
* tool_operate: Don't use Windows CA store as a fallbackJay Satiro2020-06-221-8/+0
| | | | | | | | | | | | | | | | | | | | | | | Background: 148534d added CURLSSLOPT_NATIVE_CA to use the Windows OS certificate store in libcurl w/ OpenSSL on Windows. CURLSSLOPT_NATIVE_CA overrides CURLOPT_CAINFO if both are set. The curl tool will fall back to CURLSSLOPT_NATIVE_CA if it could not find a certificate bundle to set via CURLOPT_CAINFO. Problem: libcurl may be built with hardcoded paths to a certificate bundle or directory, and if CURLSSLOPT_NATIVE_CA is used then those paths are ignored. Solution: A solution is still being discussed but since there's an impending release this commit removes using CURLSSLOPT_NATIVE_CA in the curl tool. Ref: https://github.com/curl/curl/issues/5585
* tool_getparam: -i is not OK if -J is usedDaniel Stenberg2020-06-222-18/+9
| | | | | Reported-by: sn on hackerone Bug: https://curl.haxx.se/docs/CVE-2020-8177.html
* urlglob: treat literal IPv6 addresses with zone IDs as a host nameDaniel Stenberg2020-06-181-20/+27
| | | | | | | | | | ... and not as a "glob". Now done by passing the supposed host to the URL parser which supposedly will do a better job at identifying "real" numerical IPv6 addresses. Reported-by: puckipedia on github Fixes #5576 Closes #5579
* tool_getparam: repair the error message for unknown flagDaniel Stenberg2020-06-181-1/+2
| | | | | | | Follow-up to 9e5669f3880674 Detected by Coverity CID 1464582 ("Logically dead code") Closes #5577
* tool_getparam: fix memory leak in parse_argsJay Satiro2020-06-091-0/+2
| | | | | | | | | Prior to this change in Windows Unicode builds most parsed options would not be freed. Found using _CrtDumpMemoryLeaks(). Ref: https://github.com/curl/curl/issues/5545
* tool_cfgable: free login_options at exitDaniel Stenberg2020-06-081-0/+1
| | | | | | | Memory leak Reported-by: Geeknik Labs Fixes #5535 Closes #5536
* all: fix codespell errorsViktor Szakats2020-05-251-1/+1
| | | | | | Reviewed-by: Jay Satiro Reviewed-by: Daniel Stenberg Closes https://github.com/curl/curl/pull/5452
* copyright: updated year ranges out of syncDaniel Stenberg2020-05-241-1/+1
| | | | ... and whitelisted a few more files in the the copyright.pl script.
* curl: remove -J "informational" written on stdoutDaniel Stenberg2020-05-231-4/+0
| | | | | | | | | | | curl would previously show "curl: Saved to filename 'name from header'" if -J was used and a name was picked from the Content-Disposition header. That output could interfer with other stdout output, such as -w. This commit removes that output line. Bug: https://curl.haxx.se/mail/archive-2020-05/0044.html Reported-by: Коваленко Анатолий Викторович Closes #5435
* tool_paramhlp: fixup C89 mistakeDaniel Stenberg2020-05-191-2/+1
| | | | Follow-up to c5f0a9db22.
* tool_paramhlp: fixed potentially uninitialized strtol() variableSiva Sivaraman2020-05-191-0/+1
| | | | | | | Seems highly unlikely to actually be possible, but better safe than sorry. Closes #5417
* tool_operate: fixed potentially uninitialized variablesSiva Sivaraman2020-05-191-5/+5
| | | | | | | ... in curl_easy_getinfo() calls. They're harmless but clearing the variables makes the code safer and comforts the reader. Closes #5416
* setopt: support certificate options in memory with struct curl_blobGilles Vollant2020-05-152-1/+94
| | | | | | | | | | | | | This change introduces a generic way to provide binary data in setopt options, called BLOBs. This change introduces these new setopts: CURLOPT_ISSUERCERT_BLOB, CURLOPT_PROXY_SSLCERT_BLOB, CURLOPT_PROXY_SSLKEY_BLOB, CURLOPT_SSLCERT_BLOB and CURLOPT_SSLKEY_BLOB. Reviewed-by: Daniel Stenberg Closes #5357
* source cleanup: remove all custom typedef structsDaniel Stenberg2020-05-1512-181/+176
| | | | | | | | | | | - Stick to a single unified way to use structs - Make checksrc complain on 'typedef struct {' - Allow them in tests, public headers and examples - Let MD4_CTX, MD5_CTX, and SHA256_CTX typedefs remain as they actually typedef different types/structs depending on build conditions. Closes #5338
* tool: support UTF-16 command line on WindowsMarcel Raad2020-05-143-10/+22
| | | | | | | | | | | | | | | | | | - use `wmain` instead of `main` when `_UNICODE` is defined [0] - define `argv_item_t` as `wchar_t *` in this case - use the curl_multibyte gear to convert the command-line arguments to UTF-8 This makes it possible to pass parameters with characters outside of the current locale on Windows, which is required for some tests, e.g. the IDN tests. Out of the box, this currently only works with the Visual Studio project files, which default to Unicode, and winbuild with the `ENABLE_UNICODE` option. [0] https://devblogs.microsoft.com/oldnewthing/?p=40643 Ref: https://github.com/curl/curl/issues/3747 Closes https://github.com/curl/curl/pull/3784
* curl_multibyte: add to curlxMarcel Raad2020-05-141-2/+4
| | | | | | | This will also be needed in the tool and tests. Ref: https://github.com/curl/curl/pull/3758#issuecomment-482197512 Closes https://github.com/curl/curl/pull/3784
* checksrc: enhance the ASTERISKSPACE and update code accordinglyDaniel Stenberg2020-05-141-2/+2
| | | | | | | | Fine: "struct hello *world" Not fine: "struct hello* world" (and variations) Closes #5386
* tool: shorten 3 --help descriptionsDaniel Stenberg2020-05-131-16/+17
| | | | | | | | --happy-eyeballs-timeout-ms, --resolve and --ssl-revoke-best-effort gen.pl already warned about these lines but we didn't listen Closes #5379
* retry-all-errors.d: Shorten the summary lineJay Satiro2020-05-121-1/+1
| | | | | | | | Follow-up to b995bb5 from a few moments ago. Reported-by: Daniel Stenberg Ref: https://github.com/curl/curl/commit/b995bb5#r39108929
* tool: Add option --retry-all-errors to retry on any errorJay Satiro2020-05-124-0/+12
| | | | | | The "sledgehammer" of retrying. Closes https://github.com/curl/curl/pull/5185
* tool_operate: only set CURLOPT_SSL_OPTIONS if SSL support is presentDaniel Stenberg2020-05-101-17/+18
| | | | | | | Reported-by: Marcel Raad Follow-up to 148534db5 Fixes #5367 Closes #5369
* CURLOPT_SSL_OPTIONS: add *_NATIVE_CA to use Windows CA store (with openssl)Gilles Vollant2020-05-083-0/+14
| | | | Closes #4346
* tool: do not declare functions with Curl_ prefixDaniel Stenberg2020-04-144-47/+41
| | | | | | | | | To avoid collision risks with private libcurl symbols when linked with static versions (or just versions not hiding internal symbols). Reported-by: hydra3333 on github Fixes #5219 Closes #5234
* cmake: add aliases so exported target names are available in treeNathaniel R. Lewis2020-04-131-1/+6
| | | | | Reviewed-by: Brad King Closes #5206
* curl: allow both --etag-compare and --etag-save with same file nameKwon-Young Choi2020-04-051-30/+30
| | | | | | | | | | | | This change inverse the order of processing for the --etag-compare and --etag-save option to process first --etag-compare. This in turn allows to use the same file name to compare and save an etag. The original behavior of not failing if the etag file does not exists is conserved. Fixes #5179 Closes #5180
* misc: copyright year updatesDaniel Stenberg2020-03-311-1/+1
| | | | Follow-up to 7a71965e9
* build: fixed build for systems with select() in unistd.hHarry Sintonen2020-03-312-0/+4
| | | | Closes #5169
* cleanup: insert newline after if() conditionsDaniel Stenberg2020-03-301-1/+2
| | | | | Our code style mandates we put the conditional block on a separate line. These mistakes are now detected by the updated checksrc.
* curl.h: remnove CURL_VERSION_ESNI. Never supported nor documentedDaniel Stenberg2020-03-291-1/+0
| | | | | | Considered experimental and therefore we can do this. Closes #5157
* writeout_json: Fix data type issuesMichael Kaufmann2020-03-273-5/+19
| | | | | | | | | | | | | | | Load long values correctly (e.g. for http_code). Use curl_off_t (not long) for: - size_download (CURLINFO_SIZE_DOWNLOAD_T) - size_upload (CURLINFO_SIZE_UPLOAD_T) The unit for these values is bytes/second, not microseconds: - speed_download (CURLINFO_SPEED_DOWNLOAD_T) - speed_upload (CURLINFO_SPEED_UPLOAD_T) Fixes #5131 Closes #5152
* docs/make: generate curl.1 from listed files onlyDaniel Stenberg2020-03-261-1/+1
| | | | | | | | | | | | | Previously it rendered the page from files matching "*.d" in the correct directory, which worked fine in git builds when the files were added but made it easy to forget adding the files to the dist. Now, only man page sections listed in DPAGES in Makefile.inc will be used, thus "forcing" us to update this to get the man page right and get it included in the dist at the same time. Ref: #5146 Closes #5149
* copyright: fix out-of-date copyright ranges and missing headersDaniel Stenberg2020-03-248-6/+69
| | | | | | | | | Reported by the new script 'scripts/copyright.pl'. The script has a regex whitelist for the files that don't need copyright headers. Removed three (mostly usesless) README files from docs/ Closes #5141
* cmdline: fix handling of OperationConfig linked list (--next)Rici Lake2020-03-202-2/+4
| | | | | | | | | | Ensures that -K/--config inserts new items at the end of the list instead of overwriting the second item, and that after a -K/--config option has been parsed, the option parser's view of the current config is update. Fixes #5120 Closes #5123
* writeout_json: use curl_off_t printf() option for the time outputDaniel Stenberg2020-03-181-1/+2
| | | | | | Follow-up to: 04c03416e68fd635a15 Closes #5115
* tool_setopt: correct the copyright year rangeDaniel Stenberg2020-03-181-1/+1
| | | | Follow-up to 5450428491
* schannel: add "best effort" revocation check optionJohannes Schindelin2020-03-185-1/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Implement new option CURLSSLOPT_REVOKE_BEST_EFFORT and --ssl-revoke-best-effort to allow a "best effort" revocation check. A best effort revocation check ignores errors that the revocation check was unable to take place. The reasoning is described in detail below and discussed further in the PR. --- When running e.g. with Fiddler, the schannel backend fails with an unhelpful error message: Unknown error (0x80092012) - The revocation function was unable to check revocation for the certificate. Sadly, many enterprise users who are stuck behind MITM proxies suffer the very same problem. This has been discussed in plenty of issues: https://github.com/curl/curl/issues/3727, https://github.com/curl/curl/issues/264, for example. In the latter, a Microsoft Edge developer even made the case that the common behavior is to ignore issues when a certificate has no recorded distribution point for revocation lists, or when the server is offline. This is also known as "best effort" strategy and addresses the Fiddler issue. Unfortunately, this strategy was not chosen as the default for schannel (and is therefore a backend-specific behavior: OpenSSL seems to happily ignore the offline servers and missing distribution points). To maintain backward-compatibility, we therefore add a new flag (`CURLSSLOPT_REVOKE_BEST_EFFORT`) and a new option (`--ssl-revoke-best-effort`) to select the new behavior. Due to the many related issues Git for Windows and GitHub Desktop, the plan is to make this behavior the default in these software packages. The test 2070 was added to verify this behavior, adapted from 310. Based-on-work-by: georgeok <giorgos.n.oikonomou@gmail.com> Co-authored-by: Markus Olsson <j.markus.olsson@gmail.com> Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de> Closes https://github.com/curl/curl/pull/4981
* windows: suppress UI in all CryptAcquireContext() callsViktor Szakats2020-03-171-6/+6
| | | | | | Ref: https://docs.microsoft.com/windows/win32/api/wincrypt/nf-wincrypt-cryptacquirecontexta#parameters Reviewed-by: Marc Hörsken Closes https://github.com/curl/curl/pull/5088
View Lorry Controller Status