url: treat missing usernames in netrc as empty

- If, after parsing netrc, there is a password with no username then
  set a blank username.

This used to be the case prior to 7d600ad (precedes 7.82). Note
parseurlandfillconn already does the same thing for URLs.

Reported-by: Raivis <standsed@users.noreply.github.com>
Testing-by: Domen Kožar
Fixes https://github.com/curl/curl/issues/8653
Closes #9334
Closes #9066

diff --git a/lib/url.c b/lib/url.c
index 54e4d04e53123f245c3a7c7345366b3a11c2b16a..33c6a2135a12141f08cd114446c2fc7620113a55 100644 (file)
--- a/lib/url.c
+++ b/lib/url.c
@@ -3050,6 +3050,12 @@ static CURLcode override_login(struct Curl_easy *data,
       /* don't update the user name below */
       userp = NULL;
     }
+    /* no user was set but a password, set a blank user */
+    if(userp && !*userp && *passwdp) {
+      *userp = strdup("");
+      if(!*userp)
+        return CURLE_OUT_OF_MEMORY;
+    }
   }
 #endif