curl_path: create the new path with dynbuf

Closes #10729

url: remove dummy protocol handler

Just two added checks were needed saves a whole handler struct.

Closes #10727

CI: retry a failed brew update too, not just brew install

Also, make sure an eventual failure ends up returning a failure code so
the job stops.

url: fix the SSH connection reuse check

Reported-by: Harry Sintonen
Closes #10735

CURLOPT_PROXY.3: curl+NSS does not handle HTTPS over unix domain socket

It results in error "NSS error -5985 (PR_ADDRESS_NOT_SUPPORTED_ERROR)"

Disabled test 1470 for NSS builds and

CURLOPT_PROXY.3: curl+NSS does not handle HTTPS over unix domain socket

It results in error "NSS error -5985 (PR_ADDRESS_NOT_SUPPORTED_ERROR)"

Disabled test 1470 for NSS builds and documented the restriction.

Reported-by: Dan Fandrich
Fixes #10723
Closes #10734

show more ...

CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe

Reported-by: Hiroki Kurosawa
Closes #10732

telnet: only accept option arguments in ascii

To avoid embedded telnet negotiation commands etc.

Reported-by: Harry Sintonen
Closes #10728

test1903: test use of COOKIEFILE - reset - COOKIEFILE

This also tests for the memory leak bug fixed by parent commit b559ef6f.

Ref: #10694

Closes https://github.com/curl/cu

test1903: test use of COOKIEFILE - reset - COOKIEFILE

This also tests for the memory leak bug fixed by parent commit b559ef6f.

Ref: #10694

Closes https://github.com/curl/curl/pull/10712

show more ...

url: fix cookielist memleak when curl_easy_reset

- Free set.cookelist in Curl_freeset instead of Curl_close.

Prior to this change the cookielist linked list wasn't freed by
curl

url: fix cookielist memleak when curl_easy_reset

- Free set.cookelist in Curl_freeset instead of Curl_close.

Prior to this change the cookielist linked list wasn't freed by
curl_easy_reset which calls Curl_freeset to free all set.

Bug: https://github.com/curl/curl/issues/10694#issuecomment-1458619157
Reported-by: Sergey Ryabinin

Closes https://github.com/curl/curl/pull/10709

show more ...

tests: fix some keywords and unused sections

tests: fix test1301 to call the right binary

It was refactored in commit 480ac6e5 but this step was missed.

tests: add timeout, SLOWDOWN and DELAY keywords to tests

These are tests that are testing timing and end up being quite slow.

RELEASE-NOTES: synced

wolfSSL: ressurect the BIO `io_result`

In pytest'ing the situation occored that wolfSSL reported an
IO error when the underlying BIO operation was returning an
CURLE_AGAIN condition.

wolfSSL: ressurect the BIO `io_result`

In pytest'ing the situation occored that wolfSSL reported an
IO error when the underlying BIO operation was returning an
CURLE_AGAIN condition.

Readding the `io_result` filter context member to detect such
situations.

Also, making sure that the returned CURLcode is initialized
on all recv operations outcome.

Closes #10716

show more ...

gssapi: align global `gss_OID_desc` vars to silence ld warnings on macOS ventura

Refs #9975 which first reported this.

Closes #10718

libssh2: only set the memory callbacks when debugging

This makes us debug libssh2 less and libcurl more when for example
running torture tests that otherwise will spend a lot of time in

libssh2: only set the memory callbacks when debugging

This makes us debug libssh2 less and libcurl more when for example
running torture tests that otherwise will spend a lot of time in libssh2
functions.

We leave libssh2 to test libssh2.

Closes #10721

show more ...

docs/SECURITY-PROCESS.md: updates

- allow Low+Medium issues to be managed through plain PRs
- update the bug-bounty part to reflect current reality

Closes #10719

tests: fix tag markup issues in some tests

tests: add `cookies` features

These tests don't work with `--disable-cookies`.

Closes https://github.com/curl/curl/pull/10713

test420: add cookies keyword

It fails with `--disable-cookies`.

Closes https://github.com/curl/curl/pull/10713

CI: Add more labeler match patterns

Also, add the CI, tests or libcurl API tags in conjunction with any
others that might also apply.

GHA: minor improvements to spellcheck

Closes #10640

test1671: fix after fix

test421: -w %{header_json} test with multiple same header names

To reproduce the issue in #10704

tool_writeout_json. fix the output for duplicate header names

Header entries with index != 0 are handled at the index 0 level so they
should then be skipped when iterated over.

tool_writeout_json. fix the output for duplicate header names

Header entries with index != 0 are handled at the index 0 level so they
should then be skipped when iterated over.

Reported-by: Boris Okunskiy
Fixes #10704
Closes #10707

show more ...