I have encountered an issue similar to #6358.
When pausing an upload, it is not actually excluded from the low speed cancelation. The issue seems to be that the condition in the code only checks if...
"the overall impression of the state of security and robustness of the cURL library was positive." I asked for, and we were granted a security audit of curl from the Mozilla Secure Open Source program a while ago.
In today's edition of #ChatGPT imagines a non-existent #curl feature, much to @bagder 's dismay...
As passed along by my colleague who discovered this, the prompt included: "find a website that is actually hosted on physical infrastructure in Guam"
and ChatGPT suggested one on #Akamai but then suggested using the no-existent --no-cdn flag to skip straight to the origin. Please don't take this as a suggestion to implement such a feature. 🙂
In 2007 I did a talk about #curl at the FSCONS conference. The video is lost in time but today I realized that FSF Europe is still hosting the torrent file.
Not too many seeders of that content left though... 😎
This change increases the minimum stack cookie for the AmigaOS build of the curl tool.
In testing, the older stack size of 16384 was causing curl to crash on heavy TLS loads
These operations are si...
It also means that all supported OpenSSL versions and forks support
TLSv1.3 after this patch.
It reduces `openssl.c` size by more than 10%, or 400 LOC.
Ref: #18822
Closes #18330
When no explicit --tls-max option is provided, curl should respect OpenSSL's system-wide crypto policy configuration instead of overriding it.
Previously, curl called SSL_CTX_set_max_proto_vers...
In the standard libc API set there are multiple functions provided that do ASCII numbers to integer conversions. They are handy and easy to use, but also error-prone and quite lenient in what they accept and silently just swallow.
Twenty-nine years ago on this day, #httpget 0.1 was released.
I found the tool a few days later and within a few months I became the maintainer. We later renamed it. Twice. The last name it got is #curl. It stuck.
httpget was my first insight and lesson into HTTP and since then I have kept learning it.
httpget 0.1 was written by Rafael Sagula, who unfortunately is not with us anymore.
## Summary:
The Arbitrary Configuration File Inclusion (ACFI) vulnerability was identified in the curl utility via the --config option. This flaw is a form of External Control of File Name...
one of the most common security reports we get in #curl is claims of various CRLF injections where a user injects a CRLF into their own command lines and that's apparently "an attack".
We have documented this risk if you pass in junk in curl options but that doesn't stop the reporters from reporting this to us. Over and over.
In the #curl security team, we get to exercise deep protocol knowledge into the bits for many protocols including version variations and exploring funny quirks we have for adapting to many 3rd party libraries as well as a thorough understanding of the C language, how ABIs work, OS/platform variations and the occasional CPU peculiarity. Did I mention build systems?
And that's only for the issues we received this weekend.
In the logic called for curl_multi_fdset().
File descriptors larger than FD_SETSIZE size are simply ignored, which of course will make things break but at least it does not trash memory.
Reported-b...
In #curl land, @vsz made a CI job that builds curl with fil-C and it runs the tests fine. Just slightly limited due to lack of dependencies as they all need to be built with fil-C as well.
Requirements for Fil-C:
not to accidentally pick up system headers. E.g. from /usr/include
on Linux. It can happen when any dependency is auto-detected on this
header path. This makes Fil-C find t...
I have spent the better part of a decade in the bug bounty industry, and my perspective on this industry is shaped by this experience. The first five year...
While on the topic of colorful #curl graphs. Complexity distribution in the source code over time. The recent effort to simplify code in curl has been done by multiple people through the last year or so. The graph's cyclomatic complexity is the score shown by the pmccabe tool.
This enables native CA certificates support on macOS
Have you followed the guidelines for contributing?
Have you ensured that your commits follow the commit style guide?
Have you checked that ...
## Summary:
When curl is built with the wolfSSH backend, the SSH/SFTP implementation in `lib/vssh/wolfssh.c` performs no server host key verification and exposes no host identity options in the...
