docs: clarify that curl passes on input unfiltered

... for several options.

Reported-by: Ophir Lojkine
Closes #12249

diff --git a/docs/cmdline-opts/header.d b/docs/cmdline-opts/header.d
index f5b768552450078e92e38555e5cde8f46379c1ba..95c1565e8f2ca88924183de0fdcb9d4ded952a36 100644 (file)
--- a/docs/cmdline-opts/header.d
+++ b/docs/cmdline-opts/header.d
@@ -34,7 +34,8 @@ with no-value then its header must be terminated with a semicolon, such as \-H
 curl makes sure that each header you add/replace is sent with the proper
 end-of-line marker, you should thus **not** add that as a part of the header
 content: do not add newlines or carriage returns, they only mess things up for
-you.
+you. curl passes on the verbatim string you give it without any filter or
+other safe guards. That includes white space and control characters.
 
 This option can take an argument in @filename style, which then adds a header
 for each line in the input file. Using @- makes curl read the header file from

diff --git a/docs/cmdline-opts/request-target.d b/docs/cmdline-opts/request-target.d
index 61ead5f2b0c91427afd8c2d4f20eaa18726c9b5e..be53c658cb96460218f9fedc64e2cfef28ea5c21 100644 (file)
--- a/docs/cmdline-opts/request-target.d
+++ b/docs/cmdline-opts/request-target.d
@@ -14,3 +14,6 @@ Tells curl to use an alternative "target" (path) instead of using the path as
 provided in the URL. Particularly useful when wanting to issue HTTP requests
 without leading slash or other data that does not follow the regular URL
 pattern, like "OPTIONS *".
+
+curl passes on the verbatim string you give it its the request without any
+filter or other safe guards. That includes white space and control characters.

diff --git a/docs/cmdline-opts/request.d b/docs/cmdline-opts/request.d
index 0020babf9163c565b7032fa4a338f2ea0a2e3894..6afd5356483ea822b2231378643829a0e5d4827a 100644 (file)
--- a/docs/cmdline-opts/request.d
+++ b/docs/cmdline-opts/request.d
@@ -12,6 +12,9 @@ See-also: request-target
 Multi: single
 ---
 Change the method to use when starting the transfer.
+
+curl passes on the verbatim string you give it its the request without any
+filter or other safe guards. That includes white space and control characters.
 .RS
 .TP 15
 **HTTP**

diff --git a/docs/libcurl/opts/CURLOPT_CUSTOMREQUEST.3 b/docs/libcurl/opts/CURLOPT_CUSTOMREQUEST.3
index 00132854e2457dba9eb486c87aefe7e9a1704f76..0f2d16bf5b395b9eeb91b1290e3458df9757acd9 100644 (file)
--- a/docs/libcurl/opts/CURLOPT_CUSTOMREQUEST.3
+++ b/docs/libcurl/opts/CURLOPT_CUSTOMREQUEST.3
@@ -39,6 +39,9 @@ When you change the request \fImethod\fP by setting
 libcurl behaves or acts in regards to the particular request method, it only
 changes the actual string sent in the request.
 
+libcurl passes on the verbatim string in its request without any filter or
+other safe guards. That includes white space and control characters.
+
 Restore to the internal default by setting this to NULL.
 
 This option can be used to specify the request:

diff --git a/docs/libcurl/opts/CURLOPT_HTTPHEADER.3 b/docs/libcurl/opts/CURLOPT_HTTPHEADER.3
index 4817927ab876115eae04a4709118f02ef5efe0a2..04b5a5087c4132bc522f1b368e20bd6f5d57e750 100644 (file)
--- a/docs/libcurl/opts/CURLOPT_HTTPHEADER.3
+++ b/docs/libcurl/opts/CURLOPT_HTTPHEADER.3
@@ -55,7 +55,9 @@ semicolon).
 
 The headers included in the linked list \fBmust not\fP be CRLF-terminated,
 because libcurl adds CRLF after each header item itself. Failure to comply
-with this might result in strange behavior.
+with this might result in strange behavior. libcurl passes on the verbatim
+strings you give it, without any filter or other safe guards. That includes
+white space and control characters.
 
 The first line in an HTTP request (containing the method, usually a GET or
 POST) is not a header and cannot be replaced using this option. Only the lines

diff --git a/docs/libcurl/opts/CURLOPT_REQUEST_TARGET.3 b/docs/libcurl/opts/CURLOPT_REQUEST_TARGET.3
index bd26a95b61972c1a9f33462409bedfd2f2fee38a..50d037a9d15b214ac4dcde7e889f2bbbb1429e13 100644 (file)
--- a/docs/libcurl/opts/CURLOPT_REQUEST_TARGET.3
+++ b/docs/libcurl/opts/CURLOPT_REQUEST_TARGET.3
@@ -34,6 +34,9 @@ CURLcode curl_easy_setopt(CURL *handle, CURLOPT_REQUEST_TARGET, string);
 .SH DESCRIPTION
 Pass a char * to string which libcurl uses in the upcoming request instead of
 the path as extracted from the URL.
+
+libcurl passes on the verbatim string in its request without any filter or
+other safe guards. That includes white space and control characters.
 .SH DEFAULT
 NULL
 .SH PROTOCOLS