From: Daniel Stenberg <daniel@haxx.se>
Date: Fri, 6 Mar 2026 22:13:07 +0000 (+0100)
Subject: [PATCH] http: only send bearer if auth is allowed
X-Git-Tag: archive/raspbian/7.88.1-10+rpi1+deb12u15^2~10
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=dfdda5d11f7c9f9b60d3e676c088fbee3c880679;p=curl.git

[PATCH] http: only send bearer if auth is allowed

Verify with test 2006

Closes #20843

Backported-by: Samuel Henrique <samueloph@debian.org>
 * Refresh patch context for lib/http.c
 * Adapt the new tests/data/test2006: reuse the
   existing test486 as the base (similarity-copy in the diff), keep the
   test definition structurally as upstream wants but also drop the two
   now-stale "#" comment lines that already differ between upstream's and
   our test486.

Backported by: Samuel Henrique <samueloph@debian.org>
 * Bookworm 7.88.1: same output_auth_headers() function, just at
   line 793 (offset +97 vs trixie). Apply only the lib/http.c hunk.
 * Drop the test additions: bookworm has neither tests/data/test486
   (which trixie's test2006 was copy-derived from) nor a way to add
   it without pulling in a non-trivial amount of unrelated test
   infrastructure. The security property is the
   Curl_auth_allowed_to_host() guard itself; tests are nice-to-have.

Gbp-Pq: Name CVE-2026-3783.patch
---

diff --git a/lib/http.c b/lib/http.c
index 3829d72d..cbed4519 100644
--- a/lib/http.c
+++ b/lib/http.c
@@ -793,8 +793,9 @@ output_auth_headers(struct Curl_easy *data,
   }
   if(authstatus->picked == CURLAUTH_BEARER) {
     /* Bearer */
-    if((!proxy && data->set.str[STRING_BEARER] &&
-        !Curl_checkheaders(data, STRCONST("Authorization")))) {
+    if(!proxy && data->set.str[STRING_BEARER] &&
+        Curl_auth_allowed_to_host(data) &&
+        !Curl_checkheaders(data, STRCONST("Authorization"))) {
       auth = "Bearer";
       result = http_output_bearer(data);
       if(result)