[PATCH] http: only send bearer if auth is allowed

Verify with test 2006

Closes #20843

Backported-by: Samuel Henrique <samueloph@debian.org>
 * Refresh patch context for lib/http.c
 * Adapt the new tests/data/test2006: reuse the
   existing test486 as the base (similarity-copy in the diff), keep the
   test definition structurally as upstream wants but also drop the two
   now-stale "#" comment lines that already differ between upstream's and
   our test486.

Backported by: Samuel Henrique <samueloph@debian.org>
 * Bookworm 7.88.1: same output_auth_headers() function, just at
   line 793 (offset +97 vs trixie). Apply only the lib/http.c hunk.
 * Drop the test additions: bookworm has neither tests/data/test486
   (which trixie's test2006 was copy-derived from) nor a way to add
   it without pulling in a non-trivial amount of unrelated test
   infrastructure. The security property is the
   Curl_auth_allowed_to_host() guard itself; tests are nice-to-have.

Gbp-Pq: Name CVE-2026-3783.patch

diff --git a/lib/http.c b/lib/http.c
index 3829d72d2986b9fa9f250240bf2fa37043a74ef3..cbed451918ab5fb301567b580d675fb014d4e019 100644 (file)
--- a/lib/http.c
+++ b/lib/http.c
@@ -793,8 +793,9 @@ output_auth_headers(struct Curl_easy *data,
   }
   if(authstatus->picked == CURLAUTH_BEARER) {
     /* Bearer */
-    if((!proxy && data->set.str[STRING_BEARER] &&
-        !Curl_checkheaders(data, STRCONST("Authorization")))) {
+    if(!proxy && data->set.str[STRING_BEARER] &&
+        Curl_auth_allowed_to_host(data) &&
+        !Curl_checkheaders(data, STRCONST("Authorization"))) {
       auth = "Bearer";
       result = http_output_bearer(data);
       if(result)