curb 1.4.1 → 1.5.0

data/ext/curb_easy.c

@@ -650,6 +650,93 @@ static int curb_host_allowlist_prereq(void *clientp,
 }
 #endif
 
+#if defined(CURB_HAVE_OPENSOCKET_NETWORK_POLICY) && defined(HAVE_CURLOPT_DOH_URL)
+/* libcurl's DoH probe transfers do not inherit the socket policy callback,
+ * so under :public the DoH endpoint must be vetted before the transfer.
+ * Only public IP literals are accepted: a hostname would be resolved outside
+ * the policy, leaving a DNS-rebinding window. The host is taken from
+ * libcurl's own URL parser so it matches what libcurl will connect to. */
+static void curb_check_public_doh_url(ruby_curl_easy *rbce, const char *doh_url) {
+  CURLU *parsed_url;
+  char *host = NULL;
+  char literal[INET6_ADDRSTRLEN + 3];
+  char *address = literal;
+  size_t len;
+  unsigned char ip[16];
+  int parsed = 0;
+
+  parsed_url = curl_url();
+  if (!parsed_url) {
+    rb_raise(rb_eNoMemError, "Failed to allocate URL parser for DoH URL check");
+  }
+  if (curl_url_set(parsed_url, CURLUPART_URL, doh_url, 0) == CURLUE_OK &&
+      curl_url_get(parsed_url, CURLUPART_HOST, &host, 0) == CURLUE_OK && host) {
+    len = strlen(host);
+    if (len < sizeof(literal)) {
+      memcpy(literal, host, len + 1);
+      parsed = 1;
+    }
+  }
+  if (host) curl_free(host);
+  curl_url_cleanup(parsed_url);
+
+  if (!parsed) {
+    rb_raise(eCurlErrUnsafeDestination,
+             "DoH URL must use a public IP address under public network policy");
+  }
+
+  len = strlen(address);
+  if (len >= 2 && address[0] == '[' && address[len - 1] == ']') {
+    address[len - 1] = '\0';
+    address++;
+  }
+
+  if (inet_pton(AF_INET, address, ip) == 1) {
+    if (curb_ipv4_is_unsafe_destination(ip) || !curb_cidr_rules_match(rbce, CURB_CIDR_FAMILY_IPV4, ip)) {
+      rb_raise(eCurlErrUnsafeDestination,
+               "DoH URL address %s is not allowed by public network policy", address);
+    }
+  } else if (inet_pton(AF_INET6, address, ip) == 1) {
+    if (curb_ipv6_is_unsafe_destination(ip) || !curb_cidr_rules_match(rbce, CURB_CIDR_FAMILY_IPV6, ip)) {
+      rb_raise(eCurlErrUnsafeDestination,
+               "DoH URL address %s is not allowed by public network policy", address);
+    }
+  } else {
+    rb_raise(eCurlErrUnsafeDestination,
+             "DoH URL must use a public IP address under public network policy (got host %s)", address);
+  }
+}
+#endif
+
+#ifdef CURB_HAVE_OPENSOCKET_NETWORK_POLICY
+/* file:// opens no socket, so the public policy's socket check never sees
+ * it. Without a protocol allowlist, reject it up front; libcurl's default
+ * redirect protocols already exclude file. The scheme comes from libcurl's
+ * parser when available. */
+static void curb_check_public_url_scheme(const char *url) {
+  int is_file = 0;
+#if LIBCURL_VERSION_NUM >= 0x073e00
+  CURLU *parsed_url = curl_url();
+  char *scheme = NULL;
+  if (!parsed_url) {
+    rb_raise(rb_eNoMemError, "Failed to allocate URL parser for scheme check");
+  }
+  if (curl_url_set(parsed_url, CURLUPART_URL, url, CURLU_GUESS_SCHEME | CURLU_NON_SUPPORT_SCHEME) == CURLUE_OK &&
+      curl_url_get(parsed_url, CURLUPART_SCHEME, &scheme, 0) == CURLUE_OK && scheme) {
+    is_file = STRCASECMP(scheme, "file") == 0;
+  }
+  if (scheme) curl_free(scheme);
+  curl_url_cleanup(parsed_url);
+#else
+  while (*url == ' ' || *url == '\t') url++;
+  is_file = STRNCASECMP(url, "file:", 5) == 0;
+#endif
+  if (is_file) {
+    rb_raise(eCurlErrUnsafeDestination, "file:// URLs are not allowed by public network policy");
+  }
+}
+#endif
+
 #ifdef CURB_HAVE_OPENSOCKET_NETWORK_POLICY
 static curl_socket_t curb_public_network_opensocket(void *clientp, curlsocktype purpose, struct curl_sockaddr *address) {
   ruby_curl_easy *rbce = (ruby_curl_easy *)clientp;
@@ -704,6 +791,14 @@ static curl_socket_t curb_public_network_opensocket(void *clientp, curlsocktype
   }
 #endif
 
+  /* Anything other than an IP socket (e.g. a Unix domain socket configured
+   * after the policy was applied) has no address to vet. Refuse it unless
+   * Unix sockets were explicitly allowed. */
+  if (!checked_destination_address && rbce && !rbce->allow_unix_socket) {
+    curb_store_destination_error(rbce, "(non-IP socket)", "is not allowed");
+    return CURL_SOCKET_BAD;
+  }
+
   if (!checked_destination_address && rbce && rbce->network_allowed_cidr_rule_count > 0) {
     curb_store_destination_error(rbce, "unknown", "outside allowed CIDR ranges");
     return CURL_SOCKET_BAD;
@@ -879,6 +974,13 @@ static int ruby_curl_easy_body_limit_exceeded(ruby_curl_easy *rbce, size_t total
   return 0;
 }
 
+/* Initial capacity for the default body/header buffers. rb_str_buf_cat grows
+ * them geometrically, so starting small costs a few reallocations at most,
+ * while a large fixed reservation stays attached to every returned body_str
+ * (a 2 KB response used to keep 32 KB alive). */
+#define CURB_DEFAULT_BODY_BUFFER_CAPA 0
+#define CURB_DEFAULT_HEADER_BUFFER_CAPA 0
+
 /* Default body handler appends to easy.body_data buffer */
 static size_t default_body_handler(char *stream,
                                    size_t size,
@@ -893,7 +995,7 @@ static size_t default_body_handler(char *stream,
   }
 
   if (NIL_P(out)) {
-    out = rb_easy_set("body_data", rb_str_buf_new(32768));
+    out = rb_easy_set("body_data", rb_str_buf_new(CURB_DEFAULT_BODY_BUFFER_CAPA));
   }
   rb_str_buf_cat(out, stream, total);
   return total;
@@ -908,7 +1010,7 @@ static size_t default_header_handler(char *stream,
   size_t total = size * nmemb;
   VALUE out = rb_easy_get("header_data");
   if (NIL_P(out)) {
-    out = rb_easy_set("header_data", rb_str_buf_new(16384));
+    out = rb_easy_set("header_data", rb_str_buf_new(CURB_DEFAULT_HEADER_BUFFER_CAPA));
   }
   rb_str_buf_cat(out, stream, total);
   return total;
@@ -1316,6 +1418,36 @@ static void ruby_curl_easy_detach(VALUE self, ruby_curl_easy *rbce) {
   rbce->multi = Qnil;
 }
 
+/* Release the curb-owned CURLOPT_STDERR stream. Callers must first stop
+ * libcurl from using it (cleanup, reset, or setopt of a replacement). */
+static void ruby_curl_easy_close_stderr_file(ruby_curl_easy *rbce) {
+  FILE *fp = rbce->stderr_file;
+  if (fp) {
+    rbce->stderr_file = NULL;
+    fclose(fp);
+  }
+}
+
+/* Open a stream curb owns on a duplicate of fd, so its lifetime is
+ * independent of the Ruby IO it came from. */
+static FILE *ruby_curl_easy_dup_stderr_file(int fd) {
+  FILE *fp;
+  int dup_fd = rb_cloexec_dup(fd);
+  if (dup_fd < 0) {
+    rb_sys_fail("dup(CURLOPT_STDERR)");
+  }
+  rb_update_max_fd(dup_fd);
+  /* "w" on an existing descriptor neither truncates nor changes O_APPEND. */
+  fp = fdopen(dup_fd, "w");
+  if (!fp) {
+    int saved_errno = errno;
+    close(dup_fd);
+    errno = saved_errno;
+    rb_sys_fail("fdopen(CURLOPT_STDERR)");
+  }
+  return fp;
+}
+
 static void ruby_curl_easy_free(ruby_curl_easy *rbce) {
   if (!rbce) {
     return;
@@ -1362,6 +1494,8 @@ static void ruby_curl_easy_free(ruby_curl_easy *rbce) {
     curl_easy_cleanup(rbce->curl);
     rbce->curl = NULL;
   }
+  /* After cleanup: libcurl may log while closing connections. */
+  ruby_curl_easy_close_stderr_file(rbce);
 
   rbce->self = Qnil;
 }
@@ -1431,6 +1565,15 @@ ruby_curl_easy *ruby_curl_easy_get_handle(VALUE self) {
   return rbce;
 }
 
+/* Entry points that hand libcurl new request state (bodies, verbs, setup)
+ * must not run while libcurl is still using the old state: replacing it
+ * mid-transfer frees buffers libcurl is reading (use-after-free). */
+static ruby_curl_easy *ruby_curl_easy_get_idle_handle(VALUE self) {
+  ruby_curl_easy *rbce = ruby_curl_easy_get_handle(self);
+  ruby_curl_easy_check_idle(rbce);
+  return rbce;
+}
+
 /* Keep libcurl's typed getinfo arguments while checking every result. */
 #define CURB_GETINFO(handle, info, output) do { \
   CURLcode info_result = curl_easy_getinfo(handle, info, output); \
@@ -1457,6 +1600,8 @@ static void ruby_curl_easy_zero(ruby_curl_easy *rbce) {
   rbce->network_allowed_hosts = NULL;
   rbce->network_allowed_cidr_rule_count = 0;
   rbce->network_allowed_host_count = 0;
+  /* Callers that may hold a stream close it before zeroing. */
+  rbce->stderr_file = NULL;
 
   /* various-typed opts */
   rbce->local_port = 0;
@@ -1466,6 +1611,8 @@ static void ruby_curl_easy_zero(ruby_curl_easy *rbce) {
   rbce->http_auth_types = 0;
   rbce->proxy_auth_types = 0;
   rbce->max_redirs = -1;
+  rbce->max_redirs_set = 0;
+  rbce->protocols_set = 0;
   rbce->timeout = 0;
   rbce->timeout_ms = 0;
   rbce->connect_timeout = 0;
@@ -1632,19 +1779,24 @@ static VALUE duplicate_upload(VALUE upload) {
 static VALUE ruby_curl_easy_clone(VALUE self) {
   ruby_curl_easy *rbce, *newrbce;
 
+  FILE *clone_stderr_file = NULL;
+
   rbce = ruby_curl_easy_get_handle(self);
 
-  newrbce = ALLOC(ruby_curl_easy);
-  if (!newrbce) {
-    rb_raise(rb_eNoMemError, "Failed to allocate memory for Curl::Easy clone");
+  /* Duplicate first: this can raise, and nothing needs unwinding yet. */
+  if (rbce->stderr_file) {
+    clone_stderr_file = ruby_curl_easy_dup_stderr_file(fileno(rbce->stderr_file));
   }
+
+  newrbce = ALLOC(ruby_curl_easy);
   /* shallow copy */
   memcpy(newrbce, rbce, sizeof(ruby_curl_easy));
 
   /* now deep copy */
   newrbce->curl = curl_easy_duphandle(rbce->curl);
   if (!newrbce->curl) {
-    free(newrbce);
+    xfree(newrbce);
+    if (clone_stderr_file) fclose(clone_stderr_file);
     rb_raise(rb_eNoMemError, "Failed to duplicate Curl::Easy handle");
   }
   /* duphandle borrows HTTPPOST, whose form is freed when the original
@@ -1654,7 +1806,8 @@ static VALUE ruby_curl_easy_clone(VALUE self) {
     CURLcode ecode = curl_easy_setopt(newrbce->curl, CURLOPT_HTTPPOST, NULL);
     if (ecode != CURLE_OK) {
       curl_easy_cleanup(newrbce->curl);
-      free(newrbce);
+      xfree(newrbce);
+      if (clone_stderr_file) fclose(clone_stderr_file);
       raise_curl_easy_error_exception(ecode);
     }
     newrbce->multipart_form_active = 0;
@@ -1669,6 +1822,13 @@ static VALUE ruby_curl_easy_clone(VALUE self) {
   newrbce->network_allowed_hosts = NULL;
   newrbce->network_allowed_host_count = 0;
 
+  /* duphandle copied the original's CURLOPT_STDERR pointer; give the clone
+   * its own stream so neither handle can outlive the other's. */
+  newrbce->stderr_file = clone_stderr_file;
+  if (clone_stderr_file) {
+    curl_easy_setopt(newrbce->curl, CURLOPT_STDERR, clone_stderr_file);
+  }
+
   /* A cloned easy should not retain ownership reference to the original multi. */
   newrbce->multi = Qnil;
   newrbce->callback_error = Qnil;
@@ -1789,6 +1949,8 @@ static VALUE ruby_curl_easy_reset(VALUE self) {
 
   ruby_curl_easy_cleanup(self, rbce);
   curl_easy_reset(rbce->curl);
+  /* reset restored libcurl's default stderr, so ours is unused now. */
+  ruby_curl_easy_close_stderr_file(rbce);
   ruby_curl_easy_zero(rbce);
   rbce->self = self;
 
@@ -2151,7 +2313,7 @@ static VALUE ruby_curl_easy_post_body_set_with_mode_body(VALUE argp) {
   char *data;
   long len;
 
-  rbce = ruby_curl_easy_get_handle(self);
+  rbce = ruby_curl_easy_get_idle_handle(self);
 
   curl = rbce->curl;
 
@@ -2247,7 +2409,7 @@ static VALUE ruby_curl_easy_put_data_set(VALUE self, VALUE data) {
   VALUE headers;
   VALUE infile_size = Qnil;
 
-  rbce = ruby_curl_easy_get_handle(self);
+  rbce = ruby_curl_easy_get_idle_handle(self);
 
   /*
    * Validate and prepare Ruby-visible state before mutating the CURL handle.
@@ -2744,14 +2906,27 @@ static VALUE ruby_curl_easy_proxy_auth_types_get(VALUE self) {
  *   easy.max_redirects = fixnum or nil               => fixnum or nil
  *
  * Set the maximum number of redirections to follow in the following +perform+
- * calls. Set to nil or -1 allow an infinite number (the default). Setting this
- * option only makes sense if +follow_location+ is also set true.
+ * calls. Set to -1 to allow an infinite number. When nil (the default), at
+ * most 30 redirects are followed, matching libcurl 8.3+ on every libcurl
+ * version. Setting this option only makes sense if +follow_location+ is also
+ * set true.
  *
  * With libcurl >= 7.15.1, setting this to 0 will cause libcurl to refuse any
  * redirect.
  */
 static VALUE ruby_curl_easy_max_redirects_set(VALUE self, VALUE max_redirs) {
-  CURB_IMMED_SETTER(ruby_curl_easy, max_redirs, -1);
+  ruby_curl_easy *rbce;
+
+  TypedData_Get_Struct(self, ruby_curl_easy, &ruby_curl_easy_data_type, rbce);
+  ruby_curl_easy_check_access(rbce);
+  if (NIL_P(max_redirs)) {
+    rbce->max_redirs = -1;
+    rbce->max_redirs_set = 0;
+  } else {
+    rbce->max_redirs = NUM2LONG(max_redirs);
+    rbce->max_redirs_set = 1;
+  }
+  return max_redirs;
 }
 
 /*
@@ -3318,7 +3493,7 @@ static VALUE ruby_curl_easy_use_netrc_q(VALUE self) {
  */
 static VALUE ruby_curl_easy_autoreferer_set(VALUE self, VALUE autoreferer) {
   ruby_curl_easy *rbce;
-  rbce = ruby_curl_easy_get_handle(self);
+  rbce = ruby_curl_easy_get_idle_handle(self);
 
   if (Qtrue == autoreferer) {
     curl_easy_setopt(rbce->curl, CURLOPT_AUTOREFERER, 1);
@@ -3819,6 +3994,37 @@ static VALUE ruby_curl_easy_on_debug_set(int argc, VALUE *argv, VALUE self) {
 
 /* =================== PERFORM =====================*/
 
+/* CR or LF in a header line would let the value inject extra headers or
+ * split the request; libcurl sends header strings verbatim. NUL would
+ * silently truncate the line. */
+static void curb_check_header_line_len(const char *ptr, long len, const char *what) {
+  if (memchr(ptr, '\r', (size_t)len) || memchr(ptr, '\n', (size_t)len) || memchr(ptr, '\0', (size_t)len)) {
+    rb_raise(rb_eArgError, "%s must not contain CR, LF, or NUL characters", what);
+  }
+}
+
+static void curb_check_header_line(VALUE str, const char *what) {
+  curb_check_header_line_len(RSTRING_PTR(str), RSTRING_LEN(str), what);
+}
+
+/* A String for the option stored under key, converting like rb_easy_get_str. */
+static VALUE curb_easy_opt_string(ruby_curl_easy *rbce, const char *key) {
+  VALUE value = rb_hash_aref(rbce->opts, rb_easy_hkey(key));
+  return RB_TYPE_P(value, T_STRING) ? value : rb_str_to_str(value);
+}
+
+static int curb_slist_has_header(const struct curl_slist *list, const char *name) {
+  size_t name_len = strlen(name);
+  for (; list; list = list->next) {
+    const char *line = list->data;
+    if (line && STRNCASECMP(line, name, name_len) == 0 &&
+        (line[name_len] == ':' || line[name_len] == ';')) {
+      return 1;
+    }
+  }
+  return 0;
+}
+
 /***********************************************
  * This is an rb_iterate callback used to set up http headers.
  */
@@ -3850,6 +4056,8 @@ static VALUE cb_each_http_header(VALUE header, VALUE wrap, int _c, const VALUE *
 
   //rb_p(header_str);
 
+  StringValue(header_str);
+  curb_check_header_line(header_str, "HTTP header");
   struct curl_slist *new_list = curl_slist_append(*list, StringValuePtr(header_str));
   if (!new_list) {
     rb_raise(rb_eNoMemError, "Failed to append to header list");
@@ -3886,6 +4094,8 @@ static VALUE cb_each_http_proxy_header(VALUE proxy_header, VALUE wrap, int _c, c
 
   //rb_p(header_str);
 
+  StringValue(proxy_header_str);
+  curb_check_header_line(proxy_header_str, "HTTP proxy header");
   struct curl_slist *new_list = curl_slist_append(*list, StringValuePtr(proxy_header_str));
   if (!new_list) {
     rb_raise(rb_eNoMemError, "Failed to append to proxy header list");
@@ -4031,6 +4241,17 @@ static VALUE ruby_curl_easy_setup_body(VALUE arg) {
     curl_easy_setopt(curl, CURLOPT_FORBID_REUSE, rbce->forbid_reuse_set ? rbce->forbid_reuse : 0L);
 #endif
   }
+  /* With a protocol allowlist, libcurl enforces it (UnsupportedProtocolError)
+   * and an explicit :file entry is a deliberate opt-in. */
+  if (rbce->network_policy == CURB_NETWORK_POLICY_PUBLIC && !rbce->protocols_set) {
+    curb_check_public_url_scheme(StringValueCStr(url));
+  }
+#ifdef HAVE_CURLOPT_DOH_URL
+  /* After the CIDR rules above are prepared. */
+  if (rbce->network_policy == CURB_NETWORK_POLICY_PUBLIC && !rb_easy_nil("doh_url")) {
+    curb_check_public_doh_url(rbce, rb_easy_get_str("doh_url"));
+  }
+#endif
 #endif
 
   // network stuff and auth
@@ -4097,7 +4318,7 @@ static VALUE ruby_curl_easy_setup_body(VALUE arg) {
     /* clear out the body_data if it was set */
     rb_easy_del("body_data");
   } else {
-    rb_easy_set("body_data", rb_str_buf_new(32768));
+    rb_easy_set("body_data", rb_str_buf_new(CURB_DEFAULT_BODY_BUFFER_CAPA));
     curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, (curl_write_callback)&default_body_handler);
     curl_easy_setopt(curl, CURLOPT_WRITEDATA, rbce);
   }
@@ -4108,7 +4329,7 @@ static VALUE ruby_curl_easy_setup_body(VALUE arg) {
     /* clear out the header_data if it was set */
     rb_easy_del("header_data");
   } else {
-    rb_easy_set("header_data", rb_str_buf_new(16384));
+    rb_easy_set("header_data", rb_str_buf_new(CURB_DEFAULT_HEADER_BUFFER_CAPA));
     curl_easy_setopt(curl, CURLOPT_HEADERFUNCTION, (curl_write_callback)&default_header_handler);
     curl_easy_setopt(curl, CURLOPT_HEADERDATA, rbce);
   }
@@ -4152,14 +4373,20 @@ static VALUE ruby_curl_easy_setup_body(VALUE arg) {
 
   curl_easy_setopt(curl, CURLOPT_HEADER, rbce->header_in_body);
   curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, rbce->follow_location);
+  /* Unset: cap at 30, libcurl's default since 8.3.0. Passing curb's old
+   * default of -1 made redirects unlimited on every libcurl version. */
+  if (!rbce->max_redirs_set) {
+    curl_easy_setopt(curl, CURLOPT_MAXREDIRS, 30L);
+  } else {
 #if LIBCURL_VERSION_NUM == 0x081000
-  /* Work around 8.16.0 regression that clamps -1 (infinite) to zero */
-  if (rbce->max_redirs >= 0) {
-    curl_easy_setopt(curl, CURLOPT_MAXREDIRS, rbce->max_redirs);
-  }
+    /* Work around 8.16.0 regression that clamps -1 (infinite) to zero */
+    if (rbce->max_redirs >= 0) {
+      curl_easy_setopt(curl, CURLOPT_MAXREDIRS, rbce->max_redirs);
+    }
 #else
-  curl_easy_setopt(curl, CURLOPT_MAXREDIRS, rbce->max_redirs);
+    curl_easy_setopt(curl, CURLOPT_MAXREDIRS, rbce->max_redirs);
 #endif
+  }
 
   curl_easy_setopt(curl, CURLOPT_HTTPPROXYTUNNEL,
                    public_policy_disables_proxy ? 0L : rbce->proxy_tunnel);
@@ -4275,9 +4502,7 @@ static VALUE ruby_curl_easy_setup_body(VALUE arg) {
     curl_easy_setopt(curl, CURLOPT_COOKIEFILE, "");
   }
 
-  if (!rb_easy_nil("cookies")) {
-    curl_easy_setopt(curl, CURLOPT_COOKIE, rb_easy_get_str("cookies"));
-  }
+  /* cookies= is applied after the HTTP headers below. */
 
   /* Set up HTTPS cert handling if necessary */
   if (!rb_easy_nil("cert")) {
@@ -4322,7 +4547,9 @@ static VALUE ruby_curl_easy_setup_body(VALUE arg) {
 
   /* Set the user-agent string if specified */
   if (!rb_easy_nil("useragent")) {
-    curl_easy_setopt(curl, CURLOPT_USERAGENT, rb_easy_get_str("useragent"));
+    VALUE useragent = curb_easy_opt_string(rbce, "useragent");
+    curb_check_header_line(useragent, "useragent");
+    curl_easy_setopt(curl, CURLOPT_USERAGENT, RSTRING_PTR(useragent));
   }
 
   /* Setup can be rerun for safety-policy changes while a handle is attached.
@@ -4339,6 +4566,7 @@ static VALUE ruby_curl_easy_setup_body(VALUE arg) {
       rb_block_call(rb_easy_get("headers"), rb_intern("each"), 0, NULL, cb_each_http_header, wrap);
     } else {
       VALUE headers_str = rb_obj_as_string(rb_easy_get("headers"));
+      curb_check_header_line(headers_str, "HTTP header");
       struct curl_slist *new_list = curl_slist_append(*hdrs, StringValuePtr(headers_str));
       if (!new_list) {
         rb_raise(rb_eNoMemError, "Failed to append to headers list");
@@ -4351,6 +4579,28 @@ static VALUE ruby_curl_easy_setup_body(VALUE arg) {
     }
   }
 
+  /* cookies=: libcurl sends CURLOPT_COOKIE to every host a redirect reaches,
+   * but drops a custom Cookie header on cross-host redirects (7.83+). So
+   * send it as a header, unless the cookie engine is on: libcurl would then
+   * emit a second Cookie line, so CURLOPT_COOKIE is kept to merge them. */
+  curl_easy_setopt(curl, CURLOPT_COOKIE, NULL);
+  if (!rb_easy_nil("cookies")) {
+    VALUE cookies = curb_easy_opt_string(rbce, "cookies");
+    curb_check_header_line(cookies, "cookies");
+    if (rbce->enable_cookies || rbce->cookielist_engine_enabled) {
+      curl_easy_setopt(curl, CURLOPT_COOKIE, RSTRING_PTR(cookies));
+    } else if (RSTRING_LEN(cookies) > 0 && !curb_slist_has_header(*hdrs, "Cookie")) {
+      /* An explicit Cookie header already wins over cookies=, as before. */
+      VALUE cookie_header = rb_str_plus(rb_str_new_cstr("Cookie: "), cookies);
+      struct curl_slist *new_list = curl_slist_append(*hdrs, StringValueCStr(cookie_header));
+      if (!new_list) {
+        rb_raise(rb_eNoMemError, "Failed to append to headers list");
+      }
+      *hdrs = new_list;
+      curl_easy_setopt(curl, CURLOPT_HTTPHEADER, *hdrs);
+    }
+  }
+
 #ifdef HAVE_CURLOPT_PROXYHEADER
   /* Setup HTTP proxy headers if necessary */
   curl_easy_setopt(curl, CURLOPT_PROXYHEADER, NULL);   // XXX: maybe we shouldn't be clearing this?
@@ -4361,6 +4611,7 @@ static VALUE ruby_curl_easy_setup_body(VALUE arg) {
       rb_block_call(rb_easy_get("proxy_headers"), rb_intern("each"), 0, NULL, cb_each_http_proxy_header, wrap);
     } else {
       VALUE proxy_headers_str = rb_obj_as_string(rb_easy_get("proxy_headers"));
+      curb_check_header_line(proxy_headers_str, "HTTP proxy header");
       struct curl_slist *new_list = curl_slist_append(*phdrs, StringValuePtr(proxy_headers_str));
       if (!new_list) {
         rb_raise(rb_eNoMemError, "Failed to append to proxy headers list");
@@ -4440,7 +4691,7 @@ VALUE ruby_curl_easy_setup(ruby_curl_easy *rbce) {
 static VALUE ruby_curl_easy_setup_self(VALUE self) {
   ruby_curl_easy *rbce;
 
-  rbce = ruby_curl_easy_get_handle(self);
+  rbce = ruby_curl_easy_get_idle_handle(self);
   ruby_curl_easy_setup(rbce);
 
   return self;
@@ -4546,11 +4797,13 @@ static VALUE ruby_curl_easy_perform_verb_str(VALUE self, const char *verb) {
   CURL *curl;
   VALUE retval;
 
-  rbce = ruby_curl_easy_get_handle(self);
+  rbce = ruby_curl_easy_get_idle_handle(self);
   curl = rbce->curl;
 
   memset(rbce->err_buf, 0, CURL_ERROR_SIZE);
 
+  if (verb) curb_check_header_line_len(verb, (long)strlen(verb), "HTTP verb");
+
   /* Use method override and adjust related options for special verbs. */
   curl_easy_setopt(curl, CURLOPT_CUSTOMREQUEST, verb);
 
@@ -4734,7 +4987,7 @@ static VALUE ruby_curl_easy_perform_post(int argc, VALUE *argv, VALUE self) {
 
   rb_scan_args(argc, argv, "*", &args_ary);
 
-  rbce = ruby_curl_easy_get_handle(self);
+  rbce = ruby_curl_easy_get_idle_handle(self);
   curl = rbce->curl;
 
   memset(rbce->err_buf, 0, CURL_ERROR_SIZE);
@@ -4793,7 +5046,7 @@ static VALUE ruby_curl_easy_perform_patch(int argc, VALUE *argv, VALUE self) {
   VALUE args_ary;
 
   rb_scan_args(argc, argv, "*", &args_ary);
-  rbce = ruby_curl_easy_get_handle(self);
+  rbce = ruby_curl_easy_get_idle_handle(self);
   curl = rbce->curl;
 
   /* Clear the error buffer */
@@ -4842,7 +5095,7 @@ static VALUE ruby_curl_easy_perform_put(int argc, VALUE *argv, VALUE self) {
   VALUE args_ary;
 
   rb_scan_args(argc, argv, "*", &args_ary);
-  rbce = ruby_curl_easy_get_handle(self);
+  rbce = ruby_curl_easy_get_idle_handle(self);
   curl = rbce->curl;
 
   memset(rbce->err_buf, 0, CURL_ERROR_SIZE);
@@ -5747,6 +6000,7 @@ static VALUE ruby_curl_easy_set_opt(VALUE self, VALUE opt, VALUE val) {
     CURB_OBJECT_HSETTER(ruby_curl_easy, url);
     } break;
   case CURLOPT_CUSTOMREQUEST:
+    if (!NIL_P(val)) curb_check_header_line(StringValue(val), "custom request method");
     curl_easy_setopt(rbce->curl, CURLOPT_CUSTOMREQUEST, NIL_P(val) ? NULL : StringValueCStr(val));
     break;
   case CURLOPT_HTTP_VERSION: {
@@ -5822,6 +6076,7 @@ static VALUE ruby_curl_easy_set_opt(VALUE self, VALUE opt, VALUE val) {
 #ifdef HAVE_CURLOPT_REQUEST_TARGET
   case CURLOPT_REQUEST_TARGET: {
     /* Forward request-target directly to libcurl as a string. */
+    if (!NIL_P(val)) curb_check_header_line(StringValue(val), "request target");
     curl_easy_setopt(rbce->curl, CURLOPT_REQUEST_TARGET, NIL_P(val) ? NULL : StringValueCStr(val));
     } break;
 #endif
@@ -5978,23 +6233,36 @@ static VALUE ruby_curl_easy_set_opt(VALUE self, VALUE opt, VALUE val) {
     curl_easy_setopt(rbce->curl, CURLOPT_HAPROXYPROTOCOL, NUM2LONG(val));
     break;
 #endif
-  case CURLOPT_STDERR:
+  case CURLOPT_STDERR: {
     // libcurl requires raw FILE pointer and this should be IO object in Ruby.
     // Tempfile or StringIO won't work.
+    FILE *stderr_file;
     Check_Type(val, T_FILE);
     GetOpenFile(val, open_f_ptr);
-    curl_easy_setopt(rbce->curl, CURLOPT_STDERR, rb_io_stdio_file(open_f_ptr));
-    /* Retain a Ruby reference to the IO to prevent GC/finalization
-     * while libcurl still holds and writes to the underlying FILE*. */
+    rb_io_check_writable(open_f_ptr);
+    /* Hand libcurl a stream curb owns on a duplicate descriptor. Passing
+     * the IO's own FILE* left libcurl writing through freed memory once the
+     * caller closed the IO, including after Multi#add. */
+#ifdef HAVE_RB_IO_DESCRIPTOR
+    stderr_file = ruby_curl_easy_dup_stderr_file(rb_io_descriptor(val));
+#else
+    stderr_file = ruby_curl_easy_dup_stderr_file(open_f_ptr->fd);
+#endif
+    curl_easy_setopt(rbce->curl, CURLOPT_STDERR, stderr_file);
+    ruby_curl_easy_close_stderr_file(rbce);
+    rbce->stderr_file = stderr_file;
+    /* Kept so completion can flush the caller's own buffered output. */
     rb_easy_set("stderr_io", val);
-    break;
+    } break;
   case CURLOPT_PROTOCOLS:
   case CURLOPT_REDIR_PROTOCOLS:
     curl_easy_setopt(rbce->curl, option, NUM2LONG(val));
+    if (option == CURLOPT_PROTOCOLS) rbce->protocols_set = 1;
     break;
 #ifdef HAVE_CURLOPT_PROTOCOLS_STR
   case CURLOPT_PROTOCOLS_STR:
     curl_easy_setopt(rbce->curl, CURLOPT_PROTOCOLS_STR, NIL_P(val) ? NULL : StringValueCStr(val));
+    rbce->protocols_set = !NIL_P(val);
     break;
 #endif
 #ifdef HAVE_CURLOPT_REDIR_PROTOCOLS_STR

data/ext/curb_easy.h

@@ -65,6 +65,8 @@ typedef struct {
   long http_auth_types;
   long proxy_auth_types;
   long max_redirs;
+  char max_redirs_set; /* user configured max_redirs (nil = libcurl-style default) */
+  char protocols_set; /* CURLOPT_PROTOCOLS(_STR) allowlist configured */
   unsigned long timeout;
   unsigned long timeout_ms;
   unsigned long connect_timeout;
@@ -113,6 +115,9 @@ typedef struct {
   struct curl_slist *curl_connect_to;
   curb_cidr_rule *network_allowed_cidr_rules;
   char **network_allowed_hosts;
+  /* CURLOPT_STDERR target. curb owns this FILE* (on a duplicated descriptor)
+   * so closing or collecting the caller's IO cannot free it under libcurl. */
+  FILE *stderr_file;
 
   /* attachment_sequence of the multi at the time this easy was last added. */
   unsigned long multi_attachment_generation;