Commit Graph

7016 Commits

Author SHA1 Message Date
Viktor Szakats
c478c7efdf
examples: fix two more cases of stat() TOCTOU
Also:
- ftpupload: bump an intermediate variable size.

Follow-up to f13250edf1 #18605

Closes #18778
2025-09-30 12:28:43 +02:00
Viktor Szakats
20142f5d06
build: avoid overriding system symbols for fopen functions
By introducing wrappers for them in the curlx namespace:
`curlx_fopen()`, `curlx_fdopen()`, `curlx_fclose()`.

The undefine/redefine/`(function)()` methods broke on systems
implementing these functions as macros. E.g. AIX 32-bit's `fopen()`.

Also:
- rename `lib/fopen.*` to `lib/curl_fopen.*` (for `Curl_fopen()`)
  to make room for the newly added `curlx/fopen.h`.
- curlx: move file-related functions from `multibyte.c` to `fopen.c`.
- tests/server: stop using the curl-specific `fopen()` implementation
  on Windows. Unicode isn't used by runtests, and it isn't critical to
  run tests on longs path. It can be re-enabled if this becomes
  necessary, or if the wrapper receives a feature that's critical for
  test servers.

Reported-by: Andrew Kirillov
Bug: https://github.com/curl/curl/issues/18510#issuecomment-3274393640

Follow-up to bf7375ecc5 #18503
Follow-up to 9863599d69 #18502
Follow-up to 3bb5e58c10 #17827

Closes #18634
2025-09-30 01:10:36 +02:00
Viktor Szakats
95e50ad694
tidy-up: miscellaneous
- GHA/checkdocs: rename `spellcheck` job to `pyspelling` to say
  the exact tool used.
- GHA/checkdocs: restore a comment.
- GHA/linux: add `-B .` to a cmake configure to avoid warning, and
  future breakage.
- autotools: use correct casing for `Schannel`.
- doh: update RFC URL.
- drop redundant parenthesis.
- fix indentation, whitespace.

Closes #18756
2025-09-27 12:59:07 +02:00
Stefan Eissing
061e265502
http: handle user-defined connection headers
When there is more than one user-supplied 'Connection: ' header, add
values that curl needs internally to the first one and emit all
subsequent ones thereafter.

Fixes #18662
Reported-by: Evgeny Grin (Karlson2k)
Closes #18686
2025-09-26 09:27:50 +02:00
Daniel Stenberg
882293cc81
KNOWN_BUGS: telnet code does not handle partial writes properly
Reported in Joshua's sarif data

Closes #18735
2025-09-25 14:42:04 +02:00
Daniel Stenberg
97e5a471e0
KNOWN_BUGS: Access violation sending client cert with SChannel
It seems we can select between crashing or leaking sensitive files
because Schannel is buggy.

Closes #17626
Closes #18679
2025-09-25 09:06:24 +02:00
Daniel Stenberg
b011e3fcfb
vssh: drop support for wolfSSH
The implementation was incomplete and lesser than the other backends. No
one ever reported a bug or requested enhancements for this, indicating
that this backend was never used.

Closes #18700
2025-09-24 22:59:33 +02:00
Viktor Szakats
acd0aa2c9d
docs: fix/tidy code fences
- INSTALL.md: fence code to avoid wrong rendering.
  Reported-by: rinsuki on github
  Fixes: https://github.com/curl/curl-www/issues/480

- use `sh` instead of `bash` as fence language, for less visual noise.

- INSTALL.md: drop stray shebang.

- ECH.md: drop indent from fenced code.

- minor tidy-ups.

Ref: https://curl.se/docs/install.html

Closes #18707
2025-09-24 15:16:09 +02:00
Viktor Szakats
051839eb8f
tidy-up: URLs
Closes #18689
2025-09-23 00:34:46 +02:00
Daniel Stenberg
1f0f0bdb19
managen: strict protocol check
- protocols MUST match one in the accept-list
- protocols are typically all uppercase
- drop All
- use SCP and SFTP instead of SSH
- add Protocols: to some options previously missing one

Closes #18675
2025-09-22 09:06:00 +02:00
Viktor Szakats
e5d9c871f0
tidy-up: assortment of small fixes
- examples/headerapi: fix wrong cast.
- curl_ngtcp2: delete stray character from error message.
- rustls: fix inline variable declaration.
- sendf: drop redundant `int` cast.
- libtest/cli_ws_data: drop cast with mismatched signedness.

Cherry-picked from #18343

Closes #18664
2025-09-21 16:50:14 +02:00
Viktor Szakats
06d00e3879
cmake: clang detection tidy-ups
Follow-up to 0513f9f878 #18645
Follow-up to fe5225b5ea #18209

Closes #18659
2025-09-21 15:26:49 +02:00
Daniel Stenberg
3dad0cfd77
write-out: make %header{} able to output *all* occurances of a header
By appending `:all:[separator]` to the header name. The `[separator]` string
is output between each header value if there are more than one to output.

Test 764 and 765 verify

Idea-by: kapsiR on github
Ref: #18449
Closes #18491
2025-09-21 00:00:29 +02:00
Daniel Stenberg
5ab120bc4e
krb5: drop support for Kerberos FTP
It was accidentally broken in commit 0f4c439fc7, shipped since
8.8.0 (May 2024) and yet not a single person has noticed or reported,
indicating that we might as well drop support for FTP Kerberos.

Krb5 support was added in 54967d2a3a (July 2007), and we have
been carrying the extra license information around since then for this
code. This commit removes the last traces of that code and thus we can
remove the extra copyright notices along with it.

Reported-by: Joshua Rogers
Closes #18577
2025-09-20 23:58:28 +02:00
Daniel Stenberg
cf3b9657bc
libssh2: up the minimum requirement to 1.9.0
Released on June 20 2019
2025-09-20 22:39:07 +02:00
Daniel Stenberg
82eeda1041
CURLOPT_HEADER/WRITEFUNCTION.md: drop '* size' since size is always 1
Closes #18640
2025-09-20 17:27:17 +02:00
Viktor Szakats
bf7375ecc5
build: avoid overriding system symbols for socket functions
Before this patch `accept4()`, `socket()`, `socketpair()`, `send()` and
`recv()` system symbols were remapped via macros, using the same name,
to local curl debug wrappers. This patch replaces these overrides by
introducing curl-namespaced macros that map either to the system symbols
or to their curl debug wrappers in `CURLDEBUG` (TrackMemory) builds.

This follows a patch that implemented the same for `accept()`.

The old method required tricks to make these redefines work in unity
builds, and avoid them interfering with system headers. These tricks
did not work for system symbols implemented as macros.

The new method allows to setup these mappings once, without interfering
with system headers, upstream macros, or unity builds. It makes builds
more robust.

Also:
- checksrc: ban all mapped functions.
- docs/examples: tidy up checksrc rules.

Follow-up to 9863599d69 #18502
Follow-up to 3bb5e58c10 #17827

Closes #18503
2025-09-20 13:44:59 +02:00
Daniel Stenberg
7a26304a95
curl_slist_append.md: clarify that a NULL pointer is not acceptable
Closes #18627
2025-09-20 12:04:47 +02:00
Viktor Szakats
1429858bce
tidy-up: update MS links, allow long URLs via checksrc
- update Microsoft documentation links.
  (also drop language designator where present.)

- checksrc: allow longer than 78 character lines if they
  contain a https URL. To make these links easier to use and parse.

- merge links that were split into two lines.

Closes #18626
2025-09-20 11:49:23 +02:00
Viktor Szakats
ad26a6cb99
tidy-up: avoid using the reserved macro namespace
To avoid hitting `-Wreserved-macro-identifier` where possible.

- amigaos: introduce local macro instead of reusing `__request()`.
- easy_lock: avoid redefining `__has_builtin()`.
  Follow-up to 33fd57b8ff #9062
- rand: drop interim macro `_random()`.
- windows: rename local macro `_tcsdup()` to `Curl_tcsdup()`.
  To avoid using the reserved macro namespace and to avoid
  colliding with `_tcsdup()` as defined by Windows headers.
- checksrc: ban `_tcsdup()` in favor of `Curl_tcsdup()`.
- tool_doswin: avoid redefining `_use_lfn()` (MS-DOS).
- tool_findfile: limit `__NO_NET_API` hack to AmigaOS.
  Syncing this pattern with `lib/netrc.c`.
  Follow-up to 784a8ec2c1 #16279
- examples/http2-upload: avoid reserved namespace for local macro.

More cases will be removed when dropping WinCE support via #17927.

Cases remain when defining external macros out of curl's control.

Ref: #18477
Closes #18482
2025-09-20 02:27:06 +02:00
Viktor Szakats
91720b620e
cmake: add CURL_CODE_COVERAGE option
To sync up with the `--enable-code-coverage` `./configure` option.

Ref: https://gcc.gnu.org/onlinedocs/gcc/Invoking-Gcov.html
Ref: https://gcc.gnu.org/onlinedocs/gcc/Cross-profiling.html
Ref: https://clang.llvm.org/docs/SourceBasedCodeCoverage.html

Closes #18468
2025-09-20 01:28:35 +02:00
Viktor Szakats
8d004781a5
build: drop the winbuild build system
In favor of CMake.

Closes #18040
2025-09-20 01:20:25 +02:00
Viktor Szakats
f13250edf1
examples: fix two issues found by CodeQL
- http2-upload: use `fstat()` to query file length to fix TOCTOU.

- ftpuploadresume: fix checking `sscanf()` return value.

Follow-up to b4922b1295 #18564
Closes #18605
2025-09-18 20:14:21 +02:00
Christian Schmitz
0f067ba4aa
libcurl-multi.md: added curl_multi_get_offt mention
The multi interface page didn't mention the new curl_multi_get_offt
function.

Closes #18579
2025-09-17 23:11:38 +02:00
Daniel Stenberg
3053a3e90f
docs/libcurl: use lowercase must
To shout less. Use bold in some places.

Closes #18570
2025-09-16 17:12:26 +02:00
Daniel Stenberg
cdb56c6666
docs/libcurl: clarify some timeout option behavior
Closes #18569
2025-09-16 16:57:28 +02:00
Viktor Szakats
619307feb0
cmake: fix building docs when the base directory contains .3
Fixing:
```
ninja: error: '<...>/basedir.md/_bld/docs/libcurl/libcurl-symbols.md',
  needed by 'docs/libcurl/curl_easy_cleanup.3', missing and no known rule to make it
```

Reported-by: Nir Azkiel
Fixes #18560
Follow-up to 898b012a9b #1288
Closes #18563
2025-09-16 12:37:11 +02:00
Viktor Szakats
f6ddc1fc1e
Makefile.example: simplify and make it configurable
- build in a single step.

- allow overriding all variables:
  source, target, compiler, libpaths, libs, flags.

Example:
```shell
LIBS= LDFLAGS= SRC=altsvc.c make -f Makefile.example
```

Closes #18554
2025-09-16 11:25:55 +02:00
Viktor Szakats
a4196e2249
tidy-up: whitespace
Closes #18553
2025-09-15 15:00:11 +02:00
Daniel Stenberg
61b79dee79
CURLOPT_TIMECONDITION.md: works for FILE and FTP as well
Closes #18551
2025-09-15 13:58:11 +02:00
Daniel Stenberg
8de37b8cda
cmdline-docs: extended, clarified, refreshed
Closes #18550
2025-09-15 11:56:36 +02:00
Viktor Szakats
e09f45fea4
dist: do not distribute CI.md
`CI.md` slipped into the 8.15.0, 8.16.0 tarballs by accident.
Remove it again and update the checker exception.

Follow-up to fa3f889752 #17463

Closes #18549
2025-09-15 11:15:31 +02:00
Stefan Eissing
de3fc1d7ad
asyn-thrdd: drop pthread_cancel
Remove use of pthread_cancel in asnyc threaded resolving. While there
are system where this works, others might leak to resource leakage
(memory, files, etc.). The popular nsswitch is one example where resolve
code can be dragged in that is not prepared.

The overall promise and mechanism of pthread_cancel() is just too
brittle and the historcal design of getaddrinfo() continues to haunt us.

Fixes #18532
Reported-by: Javier Blazquez
Closes #18540
2025-09-15 09:25:43 +02:00
Daniel Stenberg
58bdfb4e1d
CURLOPT_SSL_VERIFYHOST.md: add see-also to two other VERIFYHOST options
Closes #18548
2025-09-14 23:53:40 +02:00
Daniel Stenberg
6bb53f29ef
TODO: remove already implemented or bad items
- remove "connect to multiple IPs in parallel"
- remove "CURLOPT_RESOLVE for any port number", It can already be
  accomplished with CURLOPT_CONNECT_TO
- remove "dynamically load modules", we don't believe in this
- remove "netrc caching and sharing", we already cache it
- remove "Offer API to flush the connection pool", this is effectively
  what CURLMOPT_NETWORK_CHANGED now allows
- remove "WebSocket read callback", introduced in 8.16.0

Closes #18542
2025-09-14 13:46:59 +02:00
Viktor Szakats
cc50f05370
GHA/codeql: re-enable for C with the default query pack
Earlier we used `security-extended` and tried `security-and-quality`.
Try the default to see how it works.

CodeQL no longer uses the project's Actions cache, also fixing
the previously seen repeat cache entry issue.

- switch to `manual` build. It's 3x faster than the default `autobuild`.
- enable more dependencies to increase coverage.
- docs/tests/CI.md: re-add CodeQL.

Ref: https://docs.github.com/en/code-security/code-scanning/managing-your-code-scanning-configuration/codeql-query-suites
Ref: https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
Ref: #16263
Ref: 173805b2e7 #15798

Closes #18528
2025-09-12 11:03:44 +02:00
Dan Fandrich
bbdb869ec7 libcurl-security.md: mention long-running connections
Some applications may want to periodically recheck the remote server
certificate, which doesn't happen on a long-running connection.

Ref: #18527
Closes #18533
2025-09-12 00:20:19 -07:00
Daniel Stenberg
d7d32ad9b9
docs/libcurl: remove ancient version references
To make the texts easier on the eye.

- Remove most free text references to curl versions before 7.60.0 (May
  2018)
- Leave those present in a HISTORY section

Most of them are already documented in symbols-in-versions anyway.

Closes #18530
2025-09-12 08:27:38 +02:00
Daniel Stenberg
57b195bf51
CURLINFO_FTP_ENTRY_PATH.md: this is for SFTP as well
Closes #18531
2025-09-12 08:26:45 +02:00
Daniel Stenberg
c184f464f7
CURLOPT_MAXLIFETIME_CONN: make default 24 hours
Set a default value to only reuse existing connections if less than 24
hours old. This makes the TLS certificate check get redone for the new
connection. An application can still set it to zero.

Closes #18527
2025-09-11 19:46:41 +02:00
Daniel Stenberg
839b22863e
ssl-sessions.md: mark option experimental
Also make managen output the experimental text with the correct
prefix/margin for the ascii version.

Closes #18523
2025-09-11 17:01:07 +02:00
Daniel Stenberg
bee4ee6141
VERSIONS: update past versions 2025-09-10 07:43:09 +02:00
Daniel Stenberg
85ba1b8067
THANKS: names from the 8.16.0 cycle 2025-09-10 07:41:00 +02:00
Daniel Stenberg
f8ff233cdf
_ENVIRONMENT.md: document NETRC
Follow-up to 378713deb2

Closes #18497
2025-09-08 22:45:30 +02:00
Daniel Stenberg
32909591d2
docs: put <> within backticks in titles
To render better markdown. Make managen warn if present "unticked" and
unescaped.

Closes #18498
2025-09-08 22:42:53 +02:00
Daniel Stenberg
07a688135d
KNOWN_BUGS: OpenSSL-QUIC problems on google.com
Closes #18336
Closes #18492
2025-09-08 11:45:33 +02:00
Daniel Stenberg
34fd7e8d2d
RELEASE-PROCEDURE.md: drop the _newslog edit mention
Because that file has now been removed from the website repository
2025-09-08 11:12:47 +02:00
Daniel Stenberg
455afa1de5
RELEASE-PROCEDURE.md: remove some old release dates, add some new 2025-09-08 10:14:12 +02:00
Daniel Stenberg
3b2cfa55a0
mailmap: unify on James 2025-09-08 09:26:22 +02:00
Viktor Szakats
10e9d512e5
BINDINGS: point a link to archive.org
The original website is hosting different content now.

Closes #18489
2025-09-07 18:59:11 +02:00