curl / Mailing Lists / curl-users / Single Mail

curl-users

Re: Adding "OPTIONS *" support, what to call the option?

From: Dan Fandrich <dan_at_coneharvesters.com>
Date: Thu, 4 May 2017 18:01:05 +0200

On Thu, May 04, 2017 at 02:54:14PM +0200, Daniel Stenberg wrote:
> On Thu, 4 May 2017, Dan Fandrich wrote:
> >>In this case it isn't really raw, it would actually just need to skip the
> >>initial slash from the path in the HTTP request. --skip-path-slash ?
> >
> >One could argue that the initial slash isn't part of the path but rather a
> >separator.
>
> A plain "curl https://curl.haxx.se/curl.css" etc would break with --raw-url
> using that definition. Not thrilled about that, it would feel a bit
> misleading.

That's true.

> >And there have been requests in the past to be able to undo the path
> >canonicalization that curl performs (e.g.
> >http://example.com/foo/../bar/baz => http://example.com/bar/baz which the
> >more general --raw-url approach would also allow.
>
> Right, the old classic: "curl https://curl.haxx.se/../../etc/passwd". I
> think it would be neat to use a --raw-url option to set libcurl's
> CURLOPT_PATH_AS_IS option, but even for this URL having it skip the

Looks like that's already exposed as --path-as-is.

> separator (initial slash) would make the server dislike you and you'd have
> to use "curl https://curl.haxx.se//../../etc/passwd" - without it being very
> clear to a user...

--path-as-is plus a new --skip-path-slash (maybe --strip-path-slash?) might
just do it.

>>> Dan
-----------------------------------------------------------
Unsubscribe: https://cool.haxx.se/list/listinfo/curl-users
Etiquette: https://curl.haxx.se/mail/etiquette.html
Received on 2017-05-04