3 ms·
A bug that was 23 years old or not
- isaacfrond 4y agotl;dr As it turned out, the old cookie code from 1998 accepted cookies that contained control codes. The control codes could be part of the name or the the content just fine, and if the user enabled the “cookie engine” curl would store those cookies and send them back in subsequent requests.
- happymellon 4y agoYou missed the bit where it says that control characters are allowed by the spec, but are new excluded because no browser or web server accepts them. Which is why it still remained in curl.