From a94973805df96269bf3f3bf0a20ccb9887313316 Mon Sep 17 00:00:00 2001 From: Daniel Stenberg Date: Wed, 9 Oct 2024 10:04:35 +0200 Subject: [PATCH] hsts: improve subdomain handling - on load, only replace existing HSTS entries if there is a full host match - on matching, prefer a full host match and secondary the longest tail subdomain match Closes #15210 Conflict:Adaptation of community patches with reference to other vendors' modification 1.Context adaptation 2.strncasecompare(&hostname[offs], sts->host, ntail)=>Curl_strncasecompare(&hostname[offs], sts->host, ntail) 3.Added if((hlen == ntail) && Curl_strncasecompare(hostname, sts->host, hlen)) modification. Reference:https://github.com/curl/curl/commit/a94973805df96269bf3f3bf0a20ccb9887313316 --- lib/hsts.c | 26 ++++++++++++++++---------- tests/data/test1660 | 2 +- 2 files changed, 17 insertions(+), 11 deletions(-) diff --git a/lib/hsts.c b/lib/hsts.c index 6035995..32151bd 100644 --- a/lib/hsts.c +++ b/lib/hsts.c @@ -238,13 +238,16 @@ CURLcode Curl_hsts_parse(struct hsts *h, const char *hostname, struct stsentry *Curl_hsts(struct hsts *h, const char *hostname, bool subdomain) { + struct stsentry *bestsub = NULL; if(h) { time_t now = time(NULL); size_t hlen = strlen(hostname); struct Curl_llist_element *e; struct Curl_llist_element *n; + size_t blen = 0; for(e = h->list.head; e; e = n) { struct stsentry *sts = e->ptr; + size_t ntail; n = e->next; if(sts->expires <= now) { /* remove expired entries */ @@ -252,20 +255,23 @@ struct stsentry *Curl_hsts(struct hsts *h, const char *hostname, hsts_free(sts); continue; } - if(subdomain && sts->includeSubDomains) { - size_t ntail = strlen(sts->host); - if(ntail < hlen) { - size_t offs = hlen - ntail; - if((hostname[offs-1] == '.') && - Curl_strncasecompare(&hostname[offs], sts->host, ntail)) - return sts; + ntail = strlen(sts->host); + if((subdomain && sts->includeSubDomains) && (ntail < hlen)) { + size_t offs = hlen - ntail; + if((hostname[offs-1] == '.') && + Curl_strncasecompare(&hostname[offs], sts->host, ntail) && + (ntail > blen)) { + /* save the tail match with the longest tail */ + bestsub = sts; + blen = ntail; } } - if(Curl_strcasecompare(hostname, sts->host)) + /* avoid strcasecompare because the host name is not null terminated */ + if((hlen == ntail) && Curl_strncasecompare(hostname, sts->host, hlen)) return sts; } } - return NULL; /* no match */ + return bestsub; } /* @@ -417,7 +423,7 @@ static CURLcode hsts_add(struct hsts *h, char *line) e = Curl_hsts(h, p, subdomain); if(!e) result = hsts_create(h, p, subdomain, expires); - else { + else if(Curl_strcasecompare(p, e->host)) { /* the same host name, use the largest expire time */ if(expires > e->expires) e->expires = expires; diff --git a/tests/data/test1660 b/tests/data/test1660 index cbbcf75..662026b 100644 --- a/tests/data/test1660 +++ b/tests/data/test1660 @@ -52,7 +52,7 @@ this.example [this.example]: 1548400797 Input 12: error 43 Input 13: error 43 Input 14: error 43 -3.example.com [example.com]: 1569905261 includeSubDomains +3.example.com [3.example.com]: 1569905261 includeSubDomains 3.example.com [example.com]: 1569905261 includeSubDomains foo.example.com [example.com]: 1569905261 includeSubDomains 'foo.xample.com' is not HSTS -- 2.33.0