From: Stefan Eissing <stefan@eissing.org>
Date: Fri, 6 Mar 2026 13:54:09 +0000 (+0100)
Subject: [PATCH] proxy-auth: additional tests
X-Git-Tag: archive/raspbian/7.88.1-10+rpi1+deb12u15^2~9
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=2daf5a6df57d880c4f0a59e147cf9de77ab4bb9d;p=curl.git

[PATCH] proxy-auth: additional tests

Also eliminate the special handling for socks proxy match.

Closes #20837

Backported-by: Samuel Henrique <samueloph@debian.org>
 * Refresh patch context for lib/url.c

Backported by: Samuel Henrique <samueloph@debian.org>
 * Bookworm 7.88.1: same proxy_info_matches and
   socks_proxy_info_matches functions, just at line 863. Bookworm's
   proxy_info_matches still uses strcasecompare() (upstream switched
   to curl_strequal() at some point post-7.88.1), so leave that
   call alone -- only add the new Curl_timestrcmp() user/passwd
   check inside it. Keep socks_proxy_info_matches() in place and
   switch the call site at line 1214 from socks_proxy_info_matches
   to proxy_info_matches, matching the trixie minimal-diff approach.
 * Drop the tests/http/test_13_proxy_auth.py and
   tests/http/testenv/curl.py hunks: bookworm has no tests/http/
   pytest infrastructure at all (those tests appeared in upstream
   later than 7.88.1).

Gbp-Pq: Name CVE-2026-3784.patch
---

diff --git a/lib/url.c b/lib/url.c
index cf0ad078..52433730 100644
--- a/lib/url.c
+++ b/lib/url.c
@@ -865,9 +865,13 @@ proxy_info_matches(const struct proxy_info *data,
 {
   if((data->proxytype == needle->proxytype) &&
      (data->port == needle->port) &&
-     strcasecompare(data->host.name, needle->host.name))
-    return TRUE;
+     strcasecompare(data->host.name, needle->host.name)) {
 
+    if(Curl_timestrcmp(data->user, needle->user) ||
+       Curl_timestrcmp(data->passwd, needle->passwd))
+      return FALSE;
+    return TRUE;
+  }
   return FALSE;
 }
 
@@ -1208,8 +1212,7 @@ ConnectionExists(struct Curl_easy *data,
         continue;
 
       if(needle->bits.socksproxy &&
-        !socks_proxy_info_matches(&needle->socks_proxy,
-                                  &check->socks_proxy))
+         !proxy_info_matches(&needle->socks_proxy, &check->socks_proxy))
         continue;
 #endif
       if(needle->bits.conn_to_host != check->bits.conn_to_host)