[gnurl] 78/222: doh: allow only http and https in debug mode

[gnunet]

This is an automated email from the git hooks/post-receive script.

ng0 pushed a commit to branch master
in repository gnurl.

commit a5bf6a36c53fd860c1e9ef92e60ec08a4ad8f8e7
Author: Paul Dreik <address@hidden>
AuthorDate: Mon Sep 23 13:11:49 2019 +0200

    doh: allow only http and https in debug mode
    
    Otherwise curl may be told to use for instance pop3 to
    communicate with the doh server, which most likely
    is not what you want.
    
    Found through fuzzing.
    
    Closes #4406
---
 lib/doh.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/doh.c b/lib/doh.c
index 05a6cc235..196e89d93 100644
--- a/lib/doh.c
+++ b/lib/doh.c
@@ -264,6 +264,9 @@ static CURLcode dohprobe(struct Curl_easy *data,
 #ifndef CURLDEBUG
     /* enforce HTTPS if not debug */
     ERROR_CHECK_SETOPT(CURLOPT_PROTOCOLS, CURLPROTO_HTTPS);
+#else
+    /* in debug mode, also allow http */
+    ERROR_CHECK_SETOPT(CURLOPT_PROTOCOLS, CURLPROTO_HTTP|CURLPROTO_HTTPS);
 #endif
     ERROR_CHECK_SETOPT(CURLOPT_TIMEOUT_MS, (long)timeout_ms);
     if(data->set.verbose)

-- 
To stop receiving notification emails like this one, please contact
address@hidden.