curl tool: --hsts is ignored for a schemeless URL starting with a slash under --proto-default http
该报告还没有中文解读。
原文摘录
摘自原文（5090 字符中的一小部分）
When the curl tool gets `--proto-default http` and a URL without a scheme that starts with a slash, such as `/example.com/path`, it skips all the options set in `http_setopts()`: `--hsts`, `--alt-svc`, the cookie options, `-L` and the rest. libcurl still performs the transfer, over plain HTTP. …
原文中的代码
cd "$(mktemp -d)"
printf 'hsts.example "20991231 23:59:59"\n' > hsts.txt
# plain-text HTTP server, needs port 8080 to be free
python3 -m http.server --bind 127.0.0.1 8080 > server.log 2>&1 &
SERVER=$!
sleep 1
# 1. Regular URL: upgraded to HTTPS by HSTS
curl -s -o /dev/null -w '%{url_effective} …默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 curl 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @samueloph · 版权归作者与 curl 所有