taf2 / curb

Ruby bindings for libcurl
Other
1.29k stars 229 forks source link

Persistent connection sends previous body when new body is not set #458

Open Pavel-Guseynov opened 1 week ago

Pavel-Guseynov commented 1 week ago

Hi!

When using a persistent connection (reusing curl), if the request body for a new request is not explicitly set, the body from the previous request is sent instead of being cleared. This behavior leads to unexpected data being transmitted, potentially causing incorrect results or data leakage.

How to Reproduce:

curl = Curl::Easy.new
curl.url = "https://webhook.site/get-your-testing-address" 
curl.post('example data') 
# HTTP body will be 'example data'
curl.post
# HTTP body will be 'example data' instead '' (nil) 

Expected Behavior: The body of the new request should be empty

Actual Behavior: The body of the previous request is sent, resulting in unintended data being included in the new request