docs/SECURITY-ADVISORY.md: how to write a curl security advisory

Closes #11080

MANUAL.md: add dict example for looking up a single definition

Closes #11077

runtests: fix -c option when run with valgrind

The curl binary argument wasn't being quoted properly. This seems to
have broken at some point after quoting was added in commit 606b29fe.

runtests: fix -c option when run with valgrind

The curl binary argument wasn't being quoted properly. This seems to
have broken at some point after quoting was added in commit 606b29fe.

Reported-by: Daniel Stenberg
Ref: #11073
Fixes #11074
Closes #11076

show more ...

runtests: support creating more than one runner process

The controller currently only creates and uses one, but more are now
possible.

Ref: #10818

runtests: spawn a new process for the test runner

When the -j option is given, a new process is spawned in which the test
programs are run and from which test servers are started. Only o

runtests: spawn a new process for the test runner

When the -j option is given, a new process is spawned in which the test
programs are run and from which test servers are started. Only one
process can be started at once, but this is sufficient to test that the
infrastructure can isolate those functions in a new task. There should
be no visible difference between the two modes at the moment.

Ref: #10818
Closes #11064

show more ...

runtests: turn singletest() into a state machine

This allows it to run in a non-blocking manner.

Ref: #10818

runtests: change runner interface to be asynchronous

Program arguments are marshalled and then written to the end of a pipe
which is later read from and the arguments unmarshalled before

runtests: change runner interface to be asynchronous

Program arguments are marshalled and then written to the end of a pipe
which is later read from and the arguments unmarshalled before the
desired function is called normally. The function return values are
then marshalled and written into another pipe when is later read from
and unmarshalled before being returned to the caller.

The implementation is currently blocking but can be made non-blocking
without any changes to the API. This allows calling multiple runners
without blocking in the future.

Ref: #10818

show more ...

runtests: call citest_finishtest in singletest

This is where citest_starttest is called.

Ref: #10818

runtests: add a runner initialization function

This sets up the runner environment to start running tests.

Ref: #10818

runtests: remove directory from server filename variables

There will soon be multiple log directories so the paths will no longer
be static in runtests.pl. Also, get rid of $SERVER2IN wh

runtests: remove directory from server filename variables

There will soon be multiple log directories so the paths will no longer
be static in runtests.pl. Also, get rid of $SERVER2IN which was not
used.

Ref: #10818

show more ...

runtests: reduce package exports after refactoring

Some recent refactoring made these export no longer necessary. Also,
stop displaying the Unix socket paths at startup since there will

runtests: reduce package exports after refactoring

Some recent refactoring made these export no longer necessary. Also,
stop displaying the Unix socket paths at startup since there will soon
be many of them and they're not that interesting.

Ref: #10818

show more ...

runtests: use a function to obtain $LOGDIR for a test

This will no longer be static soon.

Ref: #10818

tool_cb_hdr: Fix 'Location:' formatting for early VTE terminals

- Disable hyperlink formatting for the 'Location:' header value in VTE
0.48.1 and earlier, since it is buggy in some of

tool_cb_hdr: Fix 'Location:' formatting for early VTE terminals

- Disable hyperlink formatting for the 'Location:' header value in VTE
0.48.1 and earlier, since it is buggy in some of those versions.

Prior to this change those terminals may show the location header value
as gibberish or show it twice.

Ref: https://gist.github.com/egmontkob/eb114294efbcd5adb1944c9f3cb5feda#backward-compatibility

Fixes https://github.com/curl/curl/issues/10428
Closes https://github.com/curl/curl/pull/11071

show more ...

quiche: disable pacing while pacing is not actually performed

Closes #11068

easy_cleanup: require a "good" handle to act

By insisting that the passed in handle is "good" (the magic number is
intact), this can limit the potential damage if a bad pointer is passed

easy_cleanup: require a "good" handle to act

By insisting that the passed in handle is "good" (the magic number is
intact), this can limit the potential damage if a bad pointer is passed
in. Like when this function is called twice on the same handle pointer.

Ref: #10964
Closes #11061

show more ...

amiga: Fix CA certificate paths for AmiSSL and MorphOS

AmiSSL stores certificates in `AmiSSL:Certs` and MorphOS stores them in
`MOSSYS:Data/SSL/curl-ca-bundle.crt`.

Closes https

amiga: Fix CA certificate paths for AmiSSL and MorphOS

AmiSSL stores certificates in `AmiSSL:Certs` and MorphOS stores them in
`MOSSYS:Data/SSL/curl-ca-bundle.crt`.

Closes https://github.com/curl/curl/pull/11059

show more ...

http2: (void)-mark when we explicitly ignore the return code

When h2_progress_egress() is called. Pointed out by Coverity.

Closes #11057

checksrc: find bad indentation in conditions without open brace

If the previous line starts with if/while/for AND ends with a closed
parenthesis and there's an equal number of open and c

checksrc: find bad indentation in conditions without open brace

If the previous line starts with if/while/for AND ends with a closed
parenthesis and there's an equal number of open and closed parentheses
on that line, verify that this line is indented $indent more steps, if
not a cpp line.

Also adjust the fall-out from this fix.

Closes #11054

show more ...

CI: Set minimal permissions on workflow ngtcp2-quictls.yml

Signed-off-by: Diogo Teles Sant'Anna <diogoteles@google.com>

Closes #11055

CI: use another glob syntax for matching files on Appveyor

The previous globbing syntax was not matching files recursively in
directories, so try appending a /* to more closely match the

CI: use another glob syntax for matching files on Appveyor

The previous globbing syntax was not matching files recursively in
directories, so try appending a /* to more closely match the examples at
https://www.appveyor.com/docs/how-to/filtering-commits/

show more ...

multi: add multi-ignore logic to multi_socket_action

The multi-ignore logic that was previously applied to
curl_multi_perform() (#10750) is here applied to the loop within
curl_multi

multi: add multi-ignore logic to multi_socket_action

The multi-ignore logic that was previously applied to
curl_multi_perform() (#10750) is here applied to the loop within
curl_multi_socket_action() to make it use the same optimization: most
handles have the same signal-ignore option state so this drastically
reduces the number of ignore/unignore calls per libcurl function invoke.

Follow-up to bc90308328afb8

Closes #11045

show more ...

http2: do flow window accounting for cancelled streams

- nghttp2 does not free connection level window flow for
aborted streams
- when closing transfers, make sure that any buffere

http2: do flow window accounting for cancelled streams

- nghttp2 does not free connection level window flow for
aborted streams
- when closing transfers, make sure that any buffered
response data is "given back" to the flow control window
- add tests test_02_22 and test_02_23 to reproduce

Closes #11052

show more ...

pingpong: fix compiler warning "assigning an enum to unsigned char"

Closes #11050

configure: fix detection of apxs (for httpd)

The condition check was turned the wrong way around!

Closes #11051

ci: `-Wno-vla` no longer necessary

We handle this issue in the source now.

Follow-up to b725fe1944b45406676ea3aff333ae3085a848d9

Reviewed-by: Marcel Raad
Reviewed-by: D

ci: `-Wno-vla` no longer necessary

We handle this issue in the source now.

Follow-up to b725fe1944b45406676ea3aff333ae3085a848d9

Reviewed-by: Marcel Raad
Reviewed-by: Daniel Stenberg
Closes #11048

show more ...