urlapi: make curl_url_set(url, CURLUPART_URL, NULL, 0) clear all parts

As per the documentation :

> Setting a part to a NULL pointer will effectively remove that
> part's conten

urlapi: make curl_url_set(url, CURLUPART_URL, NULL, 0) clear all parts

As per the documentation :

> Setting a part to a NULL pointer will effectively remove that
> part's contents from the CURLU handle.

But currently clearing CURLUPART_URL does nothing and returns
CURLUE_OK. This change will clear all parts of the URL at once.

Closes #9028

show more ...

copyright: make repository REUSE compliant

Add licensing and copyright information for all files in this repository. This
either happens in the file itself as a comment header or in the

copyright: make repository REUSE compliant

Add licensing and copyright information for all files in this repository. This
either happens in the file itself as a comment header or in the file
`.reuse/dep5`.

This commit also adds a Github workflow to check pull requests and adapts
copyright.pl to the changes.

Closes #8869

show more ...

libtest/lib1560: verify the host name percent decode fix

urlapi: if possible, shorten given numerical IPv6 addresses

Extended test 1560 to verify

Closes #8206

urlapi: accept port number zero

This is a regression since 7.62.0 (fb30ac5a2d).

Updated test 1560 accordingly

Reported-by: Brad Fitzpatrick
Fixes #8090
Closes #8091

urlapi: provide more detailed return codes

Previously, the return code CURLUE_MALFORMED_INPUT was used for almost
30 different URL format violations. This made it hard for users to
u

urlapi: provide more detailed return codes

Previously, the return code CURLUE_MALFORMED_INPUT was used for almost
30 different URL format violations. This made it hard for users to
understand why a particular URL was not acceptable. Since the API cannot
point out a specific position within the URL for the problem, this now
instead introduces a number of additional and more fine-grained error
codes to allow the API to return more exactly in what "part" or section
of the URL a problem was detected.

Also bug-fixes curl_url_get() with CURLUPART_ZONEID, which previously
returned CURLUE_OK even if no zoneid existed.

Test cases in 1560 have been adjusted and extended. Tests 1538 and 1559
have been updated.

Updated libcurl-errors.3 and curl_url_strerror() accordingly.

Closes #8049

show more ...

urlapi: reject short file URLs

file URLs that are 6 bytes or shorter are not complete. Return
CURLUE_MALFORMED_INPUT for those. Extended test 1560 to verify.

Triggered by #8041

urlapi: reject short file URLs

file URLs that are 6 bytes or shorter are not complete. Return
CURLUE_MALFORMED_INPUT for those. Extended test 1560 to verify.

Triggered by #8041
Closes #8042

show more ...

urlapi: URL decode percent-encoded host names

The host name is stored decoded and can be encoded when used to extract
the full URL. By default when extracting the URL, the host name will

urlapi: URL decode percent-encoded host names

The host name is stored decoded and can be encoded when used to extract
the full URL. By default when extracting the URL, the host name will not
be URL encoded to work as similar as possible as before. When not URL
encoding the host name, the '%' character will however still be encoded.

Getting the URL with the CURLU_URLENCODE flag set will percent encode
the host name part.

As a bonus, setting the host name part with curl_url_set() no longer
accepts a name that contains space, CR or LF.

Test 1560 has been extended to verify percent encodings.

Reported-by: Noam Moshe
Reported-by: Sharon Brizinov
Reported-by: Raul Onitza-Klugman
Reported-by: Kirill Efimov
Fixes #7830
Closes #7834

show more ...

urlapi: support UNC paths in file: URLs on Windows

- file://host.name/path/file.txt is a valid UNC path
\\host.name\path\files.txt to a non-local file transformed into URI
(RFC 8

urlapi: support UNC paths in file: URLs on Windows

- file://host.name/path/file.txt is a valid UNC path
\\host.name\path\files.txt to a non-local file transformed into URI
(RFC 8089 Appendix E.3)

- UNC paths on other OSs must be smb: URLs

Closes #7366

show more ...

urlapi: add curl_url_strerror()

Add curl_url_strerror() to convert CURLUcode into readable string and
facilitate easier troubleshooting in programs using URL API.
Extend CURLUcode wi

urlapi: add curl_url_strerror()

Add curl_url_strerror() to convert CURLUcode into readable string and
facilitate easier troubleshooting in programs using URL API.
Extend CURLUcode with CURLU_LAST for iteration in unit tests.
Update man pages with a mention of new function.
Update example code and tests with new functionality where it fits.

Closes #7605

show more ...

cleanup: constify unmodified static structs

Constify a number of static structs that are never modified. Make them
const to show this.

Closes #7759

curl_url_set: reject spaces in URLs w/o CURLU_ALLOW_SPACE

They were never officially allowed and slipped in only due to sloppy
parsing. Spaces (ascii 32) should be correctly encoded (to

curl_url_set: reject spaces in URLs w/o CURLU_ALLOW_SPACE

They were never officially allowed and slipped in only due to sloppy
parsing. Spaces (ascii 32) should be correctly encoded (to %20) before
being part of a URL.

The new flag bit CURLU_ALLOW_SPACE when a full URL is set, makes libcurl
allow spaces.

Updated test 1560 to verify.

Closes #7073

show more ...

urlapi: make sure no +/- signs are accepted in IPv4 numericals

Follow-up to 56a037cc0ad1b2. Extends test 1560 to verify.

Reported-by: Tuomas Siipola
Fixes #6916
Closes #6917

urlapi: "normalize" numerical IPv4 host names

When the host name in a URL is given as an IPv4 numerical address, the
address can be specified with dotted numericals in four different way

urlapi: "normalize" numerical IPv4 host names

When the host name in a URL is given as an IPv4 numerical address, the
address can be specified with dotted numericals in four different ways:
a32, a.b24, a.b.c16 or a.b.c.d and each part can be specified in
decimal, octal (0-prefixed) or hexadecimal (0x-prefixed).

Instead of passing on the name as-is and leaving the handling to the
underlying name functions, which made them not work with c-ares but work
with getaddrinfo, this change now makes the curl URL API itself detect
and "normalize" host names specified as IPv4 numericals.

The WHATWG URL Spec says this is an okay way to specify a host name in a
URL. RFC 3896 does not allow them, but curl didn't prevent them before
and it seems other RFC 3896-using tools have not either. Host names used
like this are widely supported by other tools as well due to the
handling being done by getaddrinfo and friends.

I decided to add the functionality into the URL API itself so that all
users of these functions get the benefits, when for example wanting to
compare two URLs. Also, it makes curl built to use c-ares now support
them as well and make curl builds more consistent.

The normalization makes HTTPS and virtual hosted HTTP work fine even
when curl gets the address specified using one of the "obscure" formats.

Test 1560 is extended to verify.

Fixes #6863
Closes #6871

show more ...

curl.se: new home

Closes #6172

urlapi: URL encode a '+' in the query part

... when asked to with CURLU_URLENCODE.

Extended test 1560 to verify.
Reported-by: Dietmar Hauser
Fixes #6086
Closes #6087

lib: fix -Wassign-enum warnings

configure --enable-debug now enables -Wassign-enum with clang,
identifying several enum "abuses" also fixed.

Reported-by: Gisle Vanem
Bug: ht

lib: fix -Wassign-enum warnings

configure --enable-debug now enables -Wassign-enum with clang,
identifying several enum "abuses" also fixed.

Reported-by: Gisle Vanem
Bug: https://github.com/curl/curl/commit/879007f8118771f4896334731aaca5850a154675#commitcomment-42087553

Closes #5929

show more ...

lib1560: verify "redirect" to double-slash leading URL

Closes #5849

test1560: avoid possibly negative association in wording

Closes #5549

urlapi: accept :: as a valid IPv6 address

Text 1560 is extended to verify.

Reported-by: Pavel Volgarev
Fixes #5344
Closes #5351

test 1560: avoid valgrind false positives

When using maximum code optimization level (-O3), valgrind wrongly
detects uses of uninitialized values in strcmp().

Preset buffers wit

test 1560: avoid valgrind false positives

When using maximum code optimization level (-O3), valgrind wrongly
detects uses of uninitialized values in strcmp().

Preset buffers with all zeroes to avoid that.

show more ...

urlapi: guess scheme correct even with credentials given

In the "scheme-less" parsing case, we need to strip off credentials
first before we guess scheme based on the host name!

urlapi: guess scheme correct even with credentials given

In the "scheme-less" parsing case, we need to strip off credentials
first before we guess scheme based on the host name!

Assisted-by: Jay Satiro
Fixes #4856
Closes #4857

show more ...

urlapi: question mark within fragment is still fragment

The parser would check for a query part before fragment, which caused it
to do wrong when the fragment contains a question mark.

urlapi: question mark within fragment is still fragment

The parser would check for a query part before fragment, which caused it
to do wrong when the fragment contains a question mark.

Extended test 1560 to verify.

Reported-by: Alex Konev
Fixes #4412
Closes #4413

show more ...

urlapi: CURLU_NO_AUTHORITY allows empty authority/host part

CURLU_NO_AUTHORITY is intended for use with unknown schemes (i.e. not
"file:///") to override cURL's default demand that an au

urlapi: CURLU_NO_AUTHORITY allows empty authority/host part

CURLU_NO_AUTHORITY is intended for use with unknown schemes (i.e. not
"file:///") to override cURL's default demand that an authority exists.

Closes #4349

show more ...

urlapi: verify the IPv6 numerical address

It needs to parse correctly. Otherwise it could be tricked into letting
through a-f using host names that libcurl would then resolve. Like
'

urlapi: verify the IPv6 numerical address

It needs to parse correctly. Otherwise it could be tricked into letting
through a-f using host names that libcurl would then resolve. Like
'[ab.be]'.

Reported-by: Thomas Vegas
Closes #4315

show more ...