CVE-2022-27779: cookie for trailing dot TLD
What the report claims
curl's cookie parser lacks Public Suffix awareness and incorrectly allows cookies to be set for TLDs with a trailing dot, leading to potential cross-site cookie leakage.
Compare with curl's recorded outcome
Known vulnerability
A real vulnerability: CVE-2022-27779 cookie for trailing dot TLD
Shown for comparison after analysis. The pipeline did not see this label.
ProveIt's finding
There is not enough information to verify the reported bug.
Why this finding?
- The cookie parsing and domain validation logic resides in lib/cookie.c, which is not included in the provided source snippets. Only lib/urldata.h (CURLcode definition) is shown.
- All six claims depend on cookie.c behavior (TLD rejection, trailing-dot acceptance, domain matching), but the deciding code is absent.
- The deterministic checks only confirm the revision exists, not that the relevant cookie code was provided.
What still needs checking
- The full lib/cookie.c file from revision 3fd1d8df3a24, specifically the functions that parse Set-Cookie Domain attributes, validate against the Public Suffix List (or TLD list), and perform domain matching when sending cookies.
How this analysis ran 6 claims · 0 citations verified
Checked against curl master on 2022-04-28 (3fd1d8df3a24). Dev evaluation split. Citation verification checks that a referenced line was in the evidence; it does not prove the model interpreted it correctly.
Review a draft reply to the reporter
Edit and verify before sending.
Thank you for the detailed report. To evaluate the claims, we need the cookie parsing code (lib/cookie.c) from the revision you tested. The provided source only shows unrelated header definitions. Please confirm the exact curl version or commit, and we will review the cookie domain validation and trailing-dot handling logic.
Inspect all claims and source code 6 claims · 1 code excerpts
Report claims
curl's cookie parser has no Public Suffix awareness
Read the reasoning
The claim references cookie.c but the provided source code only shows lib/urldata.h (CURLcode definition). The cookie parsing logic is not in the provided snippets.
curl will reject TLDs from being allowed
Read the reasoning
The claim references CURLOPT_COOKIEFILE but the provided source does not contain cookie.c or the cookie domain validation logic that would reject TLDs.
a cookie can still be set for a TLD + trailing dot
Read the reasoning
The claim references CURLOPT_COOKIEJAR but the cookie acceptance logic for TLD + trailing dot is in cookie.c, which is not provided.
curl will send the http://example.com. to http://example.com
Read the reasoning
The claim references CURLOPT_COOKIELIB but the cookie sending logic (domain matching with trailing dot) is in cookie.c, not provided.
cookies can be set by arbitrary sites for TLD + "."
Read the reasoning
Same as C3/C4 - requires cookie.c which is not in the provided source.
if a trailing dot is used for an unrelated site, curl will send the cookie to the unrelated site
Read the reasoning
Same as C4/C5 - requires cookie.c domain matching logic which is not provided.
What the report says about other projects
not addressed curl's cookie parser has no Public Suffix awareness
Read the original report
Source code
| 122 | typedef CURLcode (*Curl_datastream)(struct Curl_easy *data, |
| 123 | struct connectdata *conn, |
| 124 | int *didwhat, |
| 125 | bool *done, |
| 126 | int select_res); |
| 127 | #endif |
| 128 | |
| 129 | #include "mime.h" |
| 130 | #include "imap.h" |
| 131 | #include "pop3.h" |
| 132 | #include "smtp.h" |
| 133 | #include "ftp.h" |
| 134 | #include "file.h" |
| 135 | #include "vssh/ssh.h" |
| 136 | #include "http.h" |
| 137 | #include "rtsp.h" |
| 138 | #include "smb.h" |
| 139 | #include "mqtt.h" |
| 140 | #include "wildcard.h" |
| 141 | #include "multihandle.h" |
| 142 | #include "quic.h" |
| 143 | #include "c-hyper.h" |
| 144 | |
| 145 | #ifdef HAVE_GSSAPI |
| 146 | # ifdef HAVE_GSSGNU |
| 147 | # include <gss.h> |
| 148 | # elif defined HAVE_GSSAPI_GSSAPI_H |
| 149 | # include <gssapi/gssapi.h> |
| 150 | # else |
| 151 | # include <gssapi.h> |
| 152 | # endif |
| 153 | # ifdef HAVE_GSSAPI_GSSAPI_GENERIC_H |
| 154 | # include <gssapi/gssapi_generic.h> |
| 155 | # endif |
| 156 | #endif |
| 157 | |
| 158 | #ifdef HAVE_LIBSSH2_H |
| 159 | #include <libssh2.h> |
| 160 | #include <libssh2_sftp.h> |
| 161 | #endif /* HAVE_LIBSSH2_H */ |
| 162 | |
| 163 | #define READBUFFER_SIZE CURL_MAX_WRITE_SIZE |
| 164 | #define READBUFFER_MAX CURL_MAX_READ_SIZE |
| 165 | #define READBUFFER_MIN 1024 |
| 166 | |
| 167 | /* The default upload buffer size, should not be smaller than |
| 168 | CURL_MAX_WRITE_SIZE, as it needs to hold a full buffer as could be sent in |
| 169 | a write callback. |
| 170 | |
| 171 | The size was 16KB for many years but was bumped to 64KB because it makes |
| 172 | libcurl able to do significantly faster uploads in some circumstances. Even |
| 173 | larger buffers can help further, but this is deemed a fair memory/speed |
| 174 | compromise. */ |
| 175 | #define UPLOADBUFFER_DEFAULT 65536 |
| 176 | #define UPLOADBUFFER_MAX (2*1024*1024) |
| 177 | #define UPLOADBUFFER_MIN CURL_MAX_WRITE_SIZE |
| 178 | |
| 179 | #define CURLEASY_MAGIC_NUMBER 0xc0dedbadU |
| 180 | #define GOOD_EASY_HANDLE(x) \ |
| 181 | ((x) && ((x)->magic == CURLEASY_MAGIC_NUMBER)) |
| 182 | |
| 183 | /* the type we use for storing a single boolean bit */ |
| 184 | #ifdef _MSC_VER |
| 185 | typedef bool bit; |
| 186 | #define BIT(x) bool x |
| 187 | #else |
| 188 | typedef unsigned int bit; |
| 189 | #define BIT(x) bit x:1 |
| 190 | #endif |
| 191 | |
| 192 | #ifdef HAVE_GSSAPI |
| 193 | /* Types needed for krb5-ftp connections */ |
| 194 | struct krb5buffer { |
| 195 | void *data; |
| 196 | size_t size; |
| 197 | size_t index; |
| 198 | BIT(eof_flag); |
| 199 | }; |