Ates Goral pointed out that libcurl's cookie parser did case insensitive

string comparisons on the path which is incorrect and provided a patch that
fixes this. I edited test case 8 to include details that test for this.

diff --git a/CHANGES b/CHANGES
index 574d513b5758d4cb58c2f8d2dbe79b97ec9456a8..a50f785a5aa057399d0e88bd32432ff9d48372c4 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -7,6 +7,10 @@
                                   Changelog
 
 Daniel (8 July 2006)
+- Ates Goral pointed out that libcurl's cookie parser did case insensitive
+  string comparisons on the path which is incorrect and provided a patch that
+  fixes this. I edited test case 8 to include details that test for this.
+
 - Ingmar Runge provided a source snippet that caused a crash. The reason for
   the crash was that libcurl internally was a bit confused about who owned the
   DNS cache at all times so if you created an easy handle that uses a shared

diff --git a/RELEASE-NOTES b/RELEASE-NOTES
index d8c66cdd2f03075c9c9347b6a50ac9c6c9b004d7..303ea8bbd573a6b288abebf9c1ce23c09fbbed4e 100644 (file)
--- a/RELEASE-NOTES
+++ b/RELEASE-NOTES
@@ -18,6 +18,7 @@ This release includes the following changes:
 
 This release includes the following bugfixes:
 
+ o cookie parser now compares paths case sensitive
  o an easy handle with shared DNS cache added to a multi handle caused a crash
  o couldn't override the Proxy-Connection: header for non-CONNECT requests
  o curl_multi_fdset() could wrongly return -1 as max_fd value
@@ -25,7 +26,7 @@ This release includes the following bugfixes:
 Other curl-related news:
 
  o yassl 1.3.7 can now be used with libcurl as an optional TLS library for
-   HTTPS/FTPS support
+   HTTPS/FTPS support: http://www.yassl.com/
  o cURLpp 0.6.0 was released: http://rrette.com/curlpp.html
  o pycurl-7.15.4 was released: http://pycurl.sf.net
 
@@ -37,6 +38,6 @@ This release would not have looked like this without help, code, reports and
 advice from friends like these:
 
  Dan Fandrich, Peter Silva, Arve Knudsen, Michael Wallner, Toshiyuki Maezawa,
- Ingmar Runge
+ Ingmar Runge, Ates Goral
 
         Thanks! (and sorry if I forgot to mention someone)

diff --git a/lib/cookie.c b/lib/cookie.c
index d934868cae0ad0861e05e575f9d1b8c1ca0656fa..00f7b0fa7fdf6b4392f12aee4d9b06836053fce6 100644 (file)
--- a/lib/cookie.c
+++ b/lib/cookie.c
@@ -760,7 +760,9 @@ struct Cookie *Curl_cookie_getlist(struct CookieInfo *c,
         /* now check the left part of the path with the cookies path
            requirement */
         if(!co->path ||
-           checkprefix(co->path, path) ) {
+           /* not using checkprefix() because matching should be
+              case-sensitive */
+           !strncmp(co->path, path, strlen(co->path)) ) {
 
           /* and now, we know this is a match and we should create an
              entry for the return-linked-list */

diff --git a/tests/data/test8 b/tests/data/test8
index 683899ae1d7dc25ddf58ae0dd84b9613209da9da..50c5d4f2bb713a2a2d9621c75f00b2bdde765358 100644 (file)
--- a/tests/data/test8
+++ b/tests/data/test8
@@ -37,6 +37,8 @@ Funny-head: yesyes
 Set-Cookie: foobar=name; domain=127.0.0.1; path=/;
 Set-Cookie: mismatch=this; domain=127.0.0.1; path="/silly/";
 Set-Cookie: partmatch=present; domain=.0.0.1; path=/;
+Set-Cookie: cookie=yes; path=/we;
+Set-Cookie: nocookie=yes; path=/WE;
 
 </file>
 </client>
@@ -50,7 +52,7 @@ Set-Cookie: partmatch=present; domain=.0.0.1; path=/;
 GET /we/want/8 HTTP/1.1\r
 Host: 127.0.0.1:%HTTPPORT\r
 Accept: */*\r
-Cookie: partmatch=present; foobar=name\r
+Cookie: cookie=yes; partmatch=present; foobar=name\r
 \r
 </protocol>
 </verify>