471 Commits

Author SHA1 Message Date
Daniel Stenberg
3dd1ffdeb0
FAQ/TODO/KNOWN_BUGS: convert to markdown
- convert to markdown
- auto-generate the TOCs on the website, remove them from the docs
- cleanups
- spellchecked
- updated links

Closes #19875
2025-12-09 10:52:56 +01:00
Viktor Szakats
d75716e4e5
tests/data: move --libcurl output to external data files
To make the test files XML-compliant, and the expected results
possibly easier to manage by keeping them in `.c` files.

Non-XML-compliant files are down to 36 after this patch.

Also:
- make all macro expansions apply to `%includetext` contents.

Closes #19799
2025-12-09 00:19:10 +01:00
Daniel Stenberg
a1c01b2015
mdlinkcheck: ignore IP numbers, allow '@' in raw URLs 2025-12-08 12:57:51 +01:00
Daniel Stenberg
51587f6f14
mdlinkcheck: detect and check "raw" links
- URLs specified outside of the markdown []() are now extracted and
  checked

- also check TODO, FAQ and KNOWN_BUGS

- more aggressive avoiding to check github.com/curl/curl, all uses of
  example domains and some more established URLs on the curl.se site

- list all errors in the end to make them easier to spot in CI logs

Closes #19848
2025-12-05 23:41:41 +01:00
Viktor Szakats
dfd781ff62
tidy-up: miscellaneous
- gnutls, mbedtls: fix casing in log messages.
- src/tool_cfgable.h: drop unused header.
- appveyor.sh: variable style.
- cmakelint.sh: sync with libssh2, catch `.cmake.in` explicitly.
- examples: drop obsolete comments, exclamation marks.
- fix comment typos, casing.

Closes #19839
2025-12-04 20:14:11 +01:00
Viktor Szakats
f553bff6ee
cmakelint: also lint CMake .in files, fix a long line
```
CMakeConfigurableFile.in
cmake_uninstall.cmake.in
curl-config.cmake.in
```

Follow-up to 16f073ef49f94412000218c9f6ad04e3fd7e4d01 #16973
Closes #19773
2025-12-01 00:03:07 +01:00
Viktor Szakats
193cb00ce9
build: stop overriding standard memory allocation functions
Before this patch curl used the C preprocessor to override standard
memory allocation symbols: malloc, calloc, strdup, realloc, free.
The goal of these is to replace them with curl's debug wrappers in
`CURLDEBUG` builds, another was to replace them with the wrappers
calling user-defined allocators in libcurl. This solution needed a bunch
of workarounds to avoid breaking external headers: it relied on include
order to do the overriding last. For "unity" builds it needed to reset
overrides before external includes. Also in test apps, which are always
built as single source files. It also needed the `(symbol)` trick
to avoid overrides in some places. This would still not fix cases where
the standard symbols were macros. It was also fragile and difficult
to figure out which was the actual function behind an alloc or free call
in a specific piece of code. This in turn caused bugs where the wrong
allocator was accidentally called.

To avoid these problems, this patch replaces this solution with
`curlx_`-prefixed allocator macros, and mapping them _once_ to either
the libcurl wrappers, the debug wrappers or the standard ones, matching
the rest of the code in libtests.

This concludes the long journey to avoid redefining standard functions
in the curl codebase.

Note: I did not update `packages/OS400/*.c` sources. They did not
`#include` `curl_setup.h`, `curl_memory.h` or `memdebug.h`, meaning
the overrides were never applied to them. This may or may not have been
correct. For now I suppressed the direct use of standard allocators
via a local `.checksrc`. Probably they (except for `curlcl.c`) should be
updated to include `curl_setup.h` and use the `curlx_` macros.

This patch changes mappings in two places:
- `lib/curl_threads.c` in libtests: Before this patch it mapped to
  libcurl allocators. After, it maps to standard allocators, like
  the rest of libtests code.
- `units`: before this patch it mapped to standard allocators. After, it
  maps to libcurl allocators.

Also:
- drop all position-dependent `curl_memory.h` and `memdebug.h` includes,
  and delete the now unnecessary headers.
- rename `Curl_tcsdup` macro to `curlx_tcsdup` and define like the other
  allocators.
- map `curlx_strdup()` to `_strdup()` on Windows (was: `strdup()`).
  To fix warnings silenced via `_CRT_NONSTDC_NO_DEPRECATE`.
- multibyte: map `curlx_convert_*()` to `_strdup()` on Windows
  (was: `strdup()`).
- src: do not reuse the `strdup` name for the local replacement.
- lib509: call `_strdup()` on Windows (was: `strdup()`).
- test1132: delete test obsoleted by this patch.
- CHECKSRC.md: update text for `SNPRINTF`.
- checksrc: ban standard allocator symbols.

Follow-up to b12da22db1f11da51082977dc21a7edee7858911 #18866
Follow-up to db98daab05aec251bcb6615d2d38dfebec291736 #18844
Follow-up to 4deea9396bc7dd25c6362fa746a57bf309c74ada #18814
Follow-up to 9678ff5b1bfea1c847aee4f9edf023e8f01c9293 #18776
Follow-up to 10bac43b873fe45869e15b36aac1c1e5bc89b6e0 #18774
Follow-up to 20142f5d06f7120ba94cbcc25c998e8d81aec85b #18634
Follow-up to bf7375ecc50e857760b0d0a668c436e208a400bd #18503
Follow-up to 9863599d69b79d290928a89bf9160f4e4e023d4e #18502
Follow-up to 3bb5e58c105d7be450b667858d1b8e7ae3ded555 #17827

Closes #19626
2025-11-28 10:44:26 +01:00
Viktor Szakats
986e6d4eae
CODE_STYLE.md: sync banned function list with checksrc.pl
Also alpha sort the list in checksrc.pl.

Closes #19733
2025-11-27 18:53:35 +01:00
Daniel Stenberg
ea7df8d076
docs: spell it Rustls with a capital R
I believe this is how the project itself uses it.

Closes #19702
2025-11-26 09:41:09 +01:00
Viktor Szakats
1e7d0bafc6
curlx/fopen: replace open CRT functions their with _s counterparts (Windows)
- `_wopen`        -> `_wsopen_s`
- `_open`, `open` -> `_sopen_s`
- `_wfopen`       -> `_wfopen_s`
- `fopen`         -> `fopen_s`
- `_wfreopen`     -> `_wfreopen_s`
- `freopen`       -> `freopen_s`

For better error handling and for using the CRT functions recommended
via warnings suppressed by `_CRT_SECURE_NO_WARNINGS`.

Also:
- add missing `freopen_s()` prototype when building with mingw-w64 <5.
  a5d824654c/
- tests/server: replace `open()` in the signal handler with `_sopen_s()`
  on Windows.
- tests/server: reduce scope of a checksrc exception to a single line.
- checksrc: ban replaced functions.

Refs:
https://learn.microsoft.com/cpp/c-runtime-library/reference/open-wopen
https://learn.microsoft.com/cpp/c-runtime-library/reference/sopen-s-wsopen-s
https://learn.microsoft.com/cpp/c-runtime-library/reference/freopen-wfreopen
https://learn.microsoft.com/cpp/c-runtime-library/reference/fopen-wfopen
https://learn.microsoft.com/cpp/c-runtime-library/reference/fopen-s-wfopen-s
https://learn.microsoft.com/cpp/c-runtime-library/reference/freopen-s-wfreopen-s

Closes #19643
2025-11-25 03:44:22 +01:00
Daniel Stenberg
56f2479c14
manage: expand the 'libcurl support required' message
Example of old text:

 --dns-ipv4-addr requires that libcurl is built to support c-ares.

New version:

 For --dns-ipv4-addr to work, it requires that the underlying libcurl is
 built to support c-ares.

Closes #19665
2025-11-24 23:35:00 +01:00
Viktor Szakats
18b9429313
curlx: replace mbstowcs/wcstombs with _s counterparts (Windows)
They are used in Windows-specific `fopen()`, `freopen`, `open()` and
`curlx_get_winapi_error()` calls, and in `fix_excessive_path()` in
Unicode builds.

Refs:
https://learn.microsoft.com/cpp/c-runtime-library/reference/mbstowcs-mbstowcs-l
https://learn.microsoft.com/cpp/c-runtime-library/reference/mbstowcs-s-mbstowcs-s-l
https://learn.microsoft.com/cpp/c-runtime-library/reference/wcstombs-wcstombs-l
https://learn.microsoft.com/cpp/c-runtime-library/reference/wcstombs-s-wcstombs-s-l

Also ban these functions via checksrc.

Co-authored-by: Jay Satiro

Closes #19581
2025-11-21 16:45:42 +01:00
Viktor Szakats
acfcc2b288
checksrc: ban _tcsncpy, wcscpy, wcsncpy
Follow-up to eaa7651374898cef89e5783b0219bdffcc0eb60e #19589

Closes #19641
2025-11-21 16:42:45 +01:00
Viktor Szakats
3d80d37cf0
curlx: add and use curlx_freopen()
To complement the existing `curlx_fopen()` internal API.
It's used by the curl's `--stderr` option.

`curlx_freopen()` adds two features to the bare `freopen()`:
- tracing for debug-enabled builds.
- Unicode and long-filename support for Windows builds.

In effect this adds long-filename and enables Unicode support for
the `--stderr <filename>` curl command-line option on Windows.

Also add to checksrc.

Follow-up to 2f17a9b654121dd1ecf4fc043c6d08a9da3522db #10673

Closes #19598
2025-11-19 22:04:53 +01:00
Viktor Szakats
1e1ec7f6c2
badwords: add more contractions, fix fallouts
Also fix hits in autotools scripts (not to enforce).

Closes #19576
2025-11-17 19:29:15 +01:00
Viktor Szakats
ad35ecba97
badwords: fix issues found in scripts and other files
Single pass, not enforced.

Also:
- pyspelling.words: drop `web page`

Closes #19572
2025-11-17 17:18:07 +01:00
Viktor Szakats
1b48c6148a
tidy-up: miscellaneous
- schannel: delete superfluous parenthesis.
- tftp: delete stray space from log output.
- ws: update guard comment.
- docs/examples: constify variables.
- runtests/servers: enclose unknown parameter between quotes.
- scripts/perlcheck.sh: drop redundant grep `-E` option.
- THANKS: move names from comments to THANKS.
- sync `--depth` option style across scripts.
- sync git repo URL ending between some scripts.
- BINDINGS.md: drop protocol from archive.org URL path.
- whitespace, indent, unfold lines.

Closes #19565
2025-11-17 13:32:43 +01:00
Viktor Szakats
8a968095df
mk-ca-bundle.pl: default to SHA256 fingerprints with -t option
Replacing previous default: MD5.

You can use the existing `-s` option to override the default.

Also bump version to 1.30.

Closes #19359
2025-11-15 03:06:33 +01:00
Daniel Stenberg
42098d1ee6
checksrc: verify close brace indent level
Closes #19512
2025-11-13 17:27:48 +01:00
Viktor Szakats
6384e2aca0
checksrc: disallow atoi and atol globally
No longer used in core and test code.

Also: allowlist in docs/examples.

Closes #19508
2025-11-13 14:28:25 +01:00
Viktor Szakats
4841e4290d
badwords: re-sync with curl-www, fix issues found
Also:
- replace `manpage` with `man page`, add to `badwords.txt`.
- badwords.pl: import `-w` feature from curl-www, syncing the two
  scripts fully.
- badwords.txt: import missing items from curl-www, syncing the two
  files fully.
- pyspelling.words: drop `cURL` allowed word.

Closes #19468
2025-11-12 00:53:44 +01:00
Viktor Szakats
d499aa5238
mk-ca-bundle.pl: use open() with argument list to replace backticks
On Windows this requires Perl 5.22 from year 2015.

Also:
- mdlinkcheck: delete redundant error handling logic.
  Follow-up to 77be4a7ab2b5a0c633b9107fd286bda1f57e4725 #19437

Closes #19461
2025-11-12 00:53:43 +01:00
Viktor Szakats
6aab1dc263
scripts: use end-of-options marker in find -exec commands
Closes #19450
2025-11-10 18:52:29 +01:00
Viktor Szakats
a8e46c5ab1
verify-release: update to avoid shellcheck warning SC2034
```
SC2034: dl appears unused
```

Also to shorten the code.

Closes #19449
2025-11-10 16:06:48 +01:00
Viktor Szakats
77be4a7ab2
mdlinkcheck: pass curl arguments to open() as list
To prevent misinterpreting quotes or other special characters.

Requires Perl 5.22+ (2015-Jun-01) on Windows.

Ref: https://perldoc.perl.org/functions/open

Closes #19437
2025-11-10 14:21:35 +01:00
Samuel Henrique
79d3e1d7d4
wcurl: import v2025.11.09
Closes #19430
2025-11-10 08:52:55 +01:00
Daniel Stenberg
6d7e924e80
checksrc.pl: detect assign followed by more than one space
And fix some code previously doing this.

Closes #19375
2025-11-05 15:18:28 +01:00
Samuel Henrique
913c1f28c9
wcurl: import v2025.11.04
Closes #19353
2025-11-04 14:15:46 +01:00
Daniel Stenberg
bc99770217
singleuse.pl: fix string warning
"Use of uninitialized value $unittests in concatenation on line 170"

Closes #19266
2025-10-28 11:34:19 +01:00
Samuel Henrique
fb0c014e30
wcurl: sync to +dev snapshot
Closes #19247
2025-10-27 08:09:58 +01:00
Viktor Szakats
da06621d61
firefox-db2pem.sh: add macOS support, tidy-ups
Cherry-picked from #19076
Closes #19086
2025-10-16 20:53:28 +02:00
Viktor Szakats
c8aaa5d2f2
scripts: pass -- before passing xargs
Also:
- GHA/checkdocs: escape `.` in -E regex expression.

Closes #19076
2025-10-16 20:45:28 +02:00
Viktor Szakats
497b3f022e
checksrc: allow disabling warnings on FIXME/TODO comments
Follow-up to 71ace9f3c16a434385fc27b3e8bffb52deb6ccd1

Closes #19048
2025-10-13 16:11:10 +02:00
Viktor Szakats
5e74b2df34
REUSE: move copyright headers to .checksrc
To make it simpler to move them around, create and delete them without
syncing with `REUSE.toml`.

Also:
- checksrc: allow empty lines in `.checksrc`.
- comment on why curl printfs are disallowed in examples.

Closes #19024
2025-10-13 11:54:22 +02:00
Stefan Eissing
357808f4ad
multi: add notifications API
Add infrastructure to colled and dispatch notifications for transfers
and the multi handle in general. Applications can register a callback
and en-/disable notification type the are interested in.

Without a callback installed, notifications are not collected. Same when
a notification type has not been enabled.

Memory allocation failures on adding notifications lead to a general
multi failure state and result in CURLM_OUT_OF_MEMORY returned from
curl_multi_perform() and curl_multi_socket*() invocations.

Closes #18432
2025-10-07 10:55:31 +02:00
Daniel Stenberg
71b5e02590
mdlinkcheck: reject URLs containing quotes
Those would be illegal anyway and would make the script misbehave

Reported-by: Stanislav Fort
Closes #18889
2025-10-06 23:38:41 +02:00
Daniel Stenberg
3b18aeb8bd
managen: verify the options used in example lines
Also fix the --knownhosts typo

Follow-up to aae18c4bdc1a3bf5

Reported-by: Daniel Terhorst-North
URL: https://mas.to/@tastapod/115327102344617386
Closes #18884
2025-10-06 23:17:33 +02:00
Viktor Szakats
b12da22db1
lib: stop overriding system printf symbols
After this patch, the codebase no longer overrides system printf
functions. Instead it explicitly calls either the curl printf functions
`curl_m*printf()` or the system ones using their original names.

Also:
- drop unused `curl_printf.h` includes.
- checksrc: ban system printf functions, allow where necessary.

Follow-up to db98daab05aec251bcb6615d2d38dfebec291736 #18844
Follow-up to 4deea9396bc7dd25c6362fa746a57bf309c74ada #18814

Closes #18866
2025-10-06 20:57:59 +02:00
Viktor Szakats
13f10add17
REUSE: bump reuse to v6, add more fences to fix issues
Closes #18895
Closes #18897
2025-10-06 20:54:26 +02:00
Viktor Szakats
34ad78da89
curlx: move Curl_strerror, use in src and tests, ban strerror globally
Also:
- tests/server: replace local `sstrerror()` with `curlx_strerror()`.
- tests/server: show the error code next to the string, where missing.
- curlx: use `curl_msnprintf()` when building for src and tests.
  (units was already using it.)
- lib: drop unused includes found along the way.
- curlx_strerror(): avoid compiler warning (and another similar one):
  ```
  In file included from servers.c:14:
  ../../lib/../../lib/curlx/strerr.c: In function ‘curlx_strerror’:
  ../../lib/../../lib/curlx/strerr.c:328:32: error: ‘snprintf’ output may be truncated before the last format character [-Werror=format-truncation=]
    328 |       SNPRINTF(buf, buflen, "%s", msg);
        |                                ^
  ../../lib/../../lib/curlx/strerr.c:47:18: note: ‘snprintf’ output 1 or more bytes (assuming 2) into a destination of size 1
     47 | #define SNPRINTF snprintf
        |                  ^
  ../../lib/../../lib/curlx/strerr.c:328:7: note: in expansion of macro ‘SNPRINTF’
    328 |       SNPRINTF(buf, buflen, "%s", msg);
        |       ^~~~~~~~
  ```

Follow-up to 45438c8d6f8e70385d66c029568524e9e803c539 #18823

Closes #18840
2025-10-06 09:44:23 +02:00
Viktor Szakats
c7fb5858a5
checksrc: fix possible endless loops/errors in the banned function logic
By quoting the search expression to be replaced. This avoid the issue
when the code leading up to a banned function contained regex characters
that the script did not explicitly handle, e.g. `+`.

Assisted-by: Daniel Stenberg

Ref: https://perldoc.perl.org/functions/quotemeta
Follow-up to dd37d6970cfd8b4cf47ebd469f03772813b92c23 #18775

Closes #18845
2025-10-04 17:49:21 +02:00
Viktor Szakats
45438c8d6f
checksrc: reduce directory-specific exceptions
By making them defaults, then fixing and/or reshuffling remaining
exceptions as necessary.

- checksrc: ban by default: `snprintf`, `vsnprintf`, `sscanf`, `strtol`.
- examples: replace `strtol` with `atoi` to avoid a checksrc exception.
- tests/libtest: replace `strtol` with `atol`.
- tests/server: replace most `strtol` with `atol`.
- tests/server: replace most `strtoul` with `atol`/`atoi`.
- tests/server: drop no longer used `util_ultous`.
- fix typo in checksrc rules: `vsnprint` -> `vsnprintf`.
- update local exceptions.

Also:
- examples: ban curl printf functions. They're discouraged in user code.
- examples: replace curl printf with system printf.
  Add `snprintf` workaround for <VS2015.
- examples/synctime: fix `-Wfloat-equal`.
- examples/synctime: exclude for non-Windows and non-UWP Windows.
- examples/synctime: build by default.

Closes #18823
2025-10-04 00:48:58 +02:00
Viktor Szakats
fff36a360e
checksrc: fix to handle ) predecing a banned function
Fixing:
```
Unmatched ) in regex; marked by <-- HERE in m/  \*buffer_len = \(ssize_t) <-- HERE
  strtol\(/ at /home/runner/work/curl/curl/scripts/checksrc.pl line 916, <$R> line 380.
```
Ref: https://github.com/curl/curl/actions/runs/18209824275/job/51848079550#step:3:5

Also add a test case.

Follow-up to 684f4cdd3ef0cc41c547fce0e45d8a059a3058b3 #18779
Cherry-picked from #18823
Closes #18836
2025-10-03 22:45:13 +02:00
Samuel Henrique
a5a17b8ddb
wcurl: import v2025.09.27
Closes #18754
2025-10-01 09:26:42 +02:00
Viktor Szakats
9678ff5b1b
build: avoid overriding system open and stat symbols
Replace them by `curlx_open()` and `curlx_stat()`.

To make it obvious in the source code what is being executed.

Also:
- tests/server: stop overriding `open()` for test servers.
  This is critical for the call made from the signal handler.
  For other calls, it's an option to use `curlx_open()`, but
  doesn't look important enough to do it, following the path
  taken with `fopen()`.

Follow-up to 10bac43b873fe45869e15b36aac1c1e5bc89b6e0 #18774
Follow-up to 20142f5d06f7120ba94cbcc25c998e8d81aec85b #18634
Follow-up to bf7375ecc50e857760b0d0a668c436e208a400bd #18503

Closes #18776
2025-09-30 16:30:09 +02:00
Viktor Szakats
684f4cdd3e
checksrc: catch banned functions when preceded by (
Also add a test case.

Closes #18779
2025-09-30 13:16:47 +02:00
Viktor Szakats
dd37d6970c
checksrc: fix possible endless loop when detecting BANNEDFUNC
If the source line had square brackets before the match, the stripping
of the banned function left the original line intact, and repeated the
check on it forever. E.g. with banned function `open` in `lib518.c`:
```c
t518_testfd[0] = open(DEV_NULL, O_RDONLY);
```

Closes #18775
2025-09-30 11:32:12 +02:00
Viktor Szakats
20142f5d06
build: avoid overriding system symbols for fopen functions
By introducing wrappers for them in the curlx namespace:
`curlx_fopen()`, `curlx_fdopen()`, `curlx_fclose()`.

The undefine/redefine/`(function)()` methods broke on systems
implementing these functions as macros. E.g. AIX 32-bit's `fopen()`.

Also:
- rename `lib/fopen.*` to `lib/curl_fopen.*` (for `Curl_fopen()`)
  to make room for the newly added `curlx/fopen.h`.
- curlx: move file-related functions from `multibyte.c` to `fopen.c`.
- tests/server: stop using the curl-specific `fopen()` implementation
  on Windows. Unicode isn't used by runtests, and it isn't critical to
  run tests on longs path. It can be re-enabled if this becomes
  necessary, or if the wrapper receives a feature that's critical for
  test servers.

Reported-by: Andrew Kirillov
Bug: https://github.com/curl/curl/issues/18510#issuecomment-3274393640

Follow-up to bf7375ecc50e857760b0d0a668c436e208a400bd #18503
Follow-up to 9863599d69b79d290928a89bf9160f4e4e023d4e #18502
Follow-up to 3bb5e58c105d7be450b667858d1b8e7ae3ded555 #17827

Closes #18634
2025-09-30 01:10:36 +02:00
Viktor Szakats
8538856662
perlcheck: parallelize
Follow-up to 34b1e146e42f2dbac5c89414a2a0458a8729a255 #18745

Closes #18750
2025-09-26 23:50:53 +02:00
Viktor Szakats
34b1e146e4
perlcheck: add script, run in CI, fix fallouts
Add script to run all Perl sources through `perl -c` to ensure no
issues, and run this script via GHA/checksrc in CI.

Fallouts:
- fix two repeated declarations.
- move `shell_quote()` from `testutil.pm` to `pathhelp.pm`, to
  avoid circular dependency in `globalconfig.pm`.

Closes #18745
2025-09-26 14:47:33 +02:00