From: Daniel Stenberg <daniel@haxx.se>
Date: Wed, 9 Oct 2024 08:04:35 +0000 (+0200)
Subject: [PATCH] hsts: improve subdomain handling
X-Git-Tag: archive/raspbian/7.88.1-10+rpi1+deb12u14^2~11
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=cfc58c0d4d7d8b97759cf4f31ec9d6b597ba2720;p=curl.git

[PATCH] hsts: improve subdomain handling

- on load, only replace existing HSTS entries if there is a full host
  match

- on matching, prefer a full host match and secondary the longest tail
  subdomain match

Closes #15210

Backported by: Aquila Macedo Costa <aquilamacedo@riseup.net>.

Changes:
- Refresh patch context.

Gbp-Pq: Name CVE-2024-9681-0.patch
---

diff --git a/lib/hsts.c b/lib/hsts.c
index 64cbae10..77017033 100644
--- a/lib/hsts.c
+++ b/lib/hsts.c
@@ -248,12 +248,14 @@ CURLcode Curl_hsts_parse(struct hsts *h, const char *hostname,
 struct stsentry *Curl_hsts(struct hsts *h, const char *hostname,
                            bool subdomain)
 {
+  struct stsentry *bestsub = NULL;
   if(h) {
     char buffer[MAX_HSTS_HOSTLEN + 1];
     time_t now = time(NULL);
     size_t hlen = strlen(hostname);
     struct Curl_llist_element *e;
     struct Curl_llist_element *n;
+    size_t blen = 0;
 
     if((hlen > MAX_HSTS_HOSTLEN) || !hlen)
       return NULL;
@@ -278,15 +280,19 @@ struct stsentry *Curl_hsts(struct hsts *h, const char *hostname,
         if(ntail < hlen) {
           size_t offs = hlen - ntail;
           if((hostname[offs-1] == '.') &&
-             strncasecompare(&hostname[offs], sts->host, ntail))
-            return sts;
+             strncasecompare(&hostname[offs], sts->host, ntail) &&
+             (ntail > blen)) {
+            /* save the tail match with the longest tail */
+            bestsub = sts;
+            blen = ntail;
+          }
         }
       }
       if(strcasecompare(hostname, sts->host))
         return sts;
     }
   }
-  return NULL; /* no match */
+  return bestsub;
 }
 
 /*
@@ -438,8 +444,8 @@ static CURLcode hsts_add(struct hsts *h, char *line)
     e = Curl_hsts(h, p, subdomain);
     if(!e)
       result = hsts_create(h, p, subdomain, expires);
-    else {
-      /* the same host name, use the largest expire time */
+    else if(strcasecompare(p, e->host)) {
+      /* the same hostname, use the largest expire time */
       if(expires > e->expires)
         e->expires = expires;
     }
diff --git a/tests/data/test1660 b/tests/data/test1660
index cbbcf758..662026b4 100644
--- a/tests/data/test1660
+++ b/tests/data/test1660
@@ -52,7 +52,7 @@ this.example [this.example]: 1548400797
 Input 12: error 43
 Input 13: error 43
 Input 14: error 43
-3.example.com [example.com]: 1569905261 includeSubDomains
+3.example.com [3.example.com]: 1569905261 includeSubDomains
 3.example.com [example.com]: 1569905261 includeSubDomains
 foo.example.com [example.com]: 1569905261 includeSubDomains
 'foo.xample.com' is not HSTS