[PATCH] proxy-auth: additional tests

Also eliminate the special handling for socks proxy match.

Closes #20837

Backported-by: Samuel Henrique <samueloph@debian.org>
 * Refresh patch context for lib/url.c

Backported by: Samuel Henrique <samueloph@debian.org>
 * Bookworm 7.88.1: same proxy_info_matches and
   socks_proxy_info_matches functions, just at line 863. Bookworm's
   proxy_info_matches still uses strcasecompare() (upstream switched
   to curl_strequal() at some point post-7.88.1), so leave that
   call alone -- only add the new Curl_timestrcmp() user/passwd
   check inside it. Keep socks_proxy_info_matches() in place and
   switch the call site at line 1214 from socks_proxy_info_matches
   to proxy_info_matches, matching the trixie minimal-diff approach.
 * Drop the tests/http/test_13_proxy_auth.py and
   tests/http/testenv/curl.py hunks: bookworm has no tests/http/
   pytest infrastructure at all (those tests appeared in upstream
   later than 7.88.1).

Gbp-Pq: Name CVE-2026-3784.patch

diff --git a/lib/url.c b/lib/url.c
index cf0ad078189b87b5d90c440aa1dd3b0a466cadf9..52433730bfc9acaa77b5bcf1ab9e227ee425aeb6 100644 (file)
--- a/lib/url.c
+++ b/lib/url.c
@@ -865,9 +865,13 @@ proxy_info_matches(const struct proxy_info *data,
 {
   if((data->proxytype == needle->proxytype) &&
      (data->port == needle->port) &&
-     strcasecompare(data->host.name, needle->host.name))
-    return TRUE;
+     strcasecompare(data->host.name, needle->host.name)) {
 
+    if(Curl_timestrcmp(data->user, needle->user) ||
+       Curl_timestrcmp(data->passwd, needle->passwd))
+      return FALSE;
+    return TRUE;
+  }
   return FALSE;
 }
 
@@ -1208,8 +1212,7 @@ ConnectionExists(struct Curl_easy *data,
         continue;
 
       if(needle->bits.socksproxy &&
-        !socks_proxy_info_matches(&needle->socks_proxy,
-                                  &check->socks_proxy))
+         !proxy_info_matches(&needle->socks_proxy, &check->socks_proxy))
         continue;
 #endif
       if(needle->bits.conn_to_host != check->bits.conn_to_host)