urlapi: compare zone-id in Curl_url_same_origin()

Closes #21686

diff --git a/lib/urlapi.c b/lib/urlapi.c
index dfb106dd2f0ac0d9a15d31996fe2d43eb119a690..21f4bbfab1be22f396560ddea9bbeb0e1142d2a0 100644 (file)
--- a/lib/urlapi.c
+++ b/lib/urlapi.c
@@ -2024,6 +2024,9 @@ bool Curl_url_same_origin(CURLU *base, CURLU *href)
   if(href->host) {
     if(!curl_strequal(base->host, href->host))
       return FALSE;
+    if(!curl_strequal(base->zoneid ? base->zoneid : "",
+                      href->zoneid ? href->zoneid : ""))
+      return FALSE;
     if(!curl_strequal(base->port, href->port)) {
       /* This may still match if only one has an explicit port
        * and it is the default for the scheme. */