CURL_NETRC_REQUIRED sends the URL password when the .netrc file has no matching entry
业务逻辑 / Expected Behavior Violation / #4137523
该报告还没有中文解读。
原文摘录
摘自原文（1722 字符中的一小部分）
Summary In required netrc mode (CURL_NETRC_REQUIRED, as set by `--netrc` or `--netrc-file`), the CURLOPT_NETRC documentation says any credential information present in the URL is ignored, but when the configured .netrc file loads successfully yet has no entry matching the requested host and …
原文中的代码
# a .netrc that loads but has no entry for user 'alice' printf 'machine example.com login bob password sekret\n' > nrc # start any local HTTP server on 127.0.0.1:$PORT that logs request headers, # then (required mode is implied by --netrc-file; URL carries user AND password): curl -v --netrc-file …
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 curl 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @tlh02 · 版权归作者与 curl 所有