CURLOPT_PROXYHEADER is not part of the HTTP-proxy connection reuse key: a second CONNECT-tunnel transfer silently reuses the first tunnel's Proxy-Auth
该报告还没有中文解读。
原文摘录
摘自原文（6865 字符中的一小部分）
When libcurl tunnels through an HTTP proxy with `CONNECT` (HTTPS-over-proxy), the custom headers set via `CURLOPT_PROXYHEADER` are sent to the proxy **once, at tunnel-setup time** (`lib/http_proxy.c:63-83`). The connection-reuse decision for a proxied connection, however, does **not** take …
原文中的代码
/* lib/url.c:540-549 */
static bool proxy_info_matches(const struct proxy_info *data,
const struct proxy_info *needle)
{
if((data->proxytype == needle->proxytype) &&
Curl_peer_same_destination(data->peer, needle->peer) &&
Curl_creds_same(data->creds, …默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 curl 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @joumaaa · 版权归作者与 curl 所有