Advisories for Cargo/Hurl package

The Bug Hurl <= 8.0.1 lets you define cookies two ways in a .hurl file: As a raw Cookie: header in the [Header]/headers area In a dedicated [Cookies] section (parsed into RequestSpec.cookies) When following a redirect to a different host, Hurl correctly strips security-sensitive data (Authorization, Cookie header, and basic-auth user) to avoid leaking credentials cross-host — mirroring libcurl's default behavior. But it only stripped the cookie that came in …

Given this Hurl file: regex.hurl: GET https://foo.com HTTP 200 [Asserts] jsonpath "$.body" matches /<img src="" onerror="alert('Hi!')">/ When exported to HTML: $ hurlfmt –out html regex.hurl <pre><code class="language-hurl"><span class="hurl-entry"><span class="request"><span class="line"><span class="method">GET</span> <span class="url">https://foo.com</span></span> </span><span class="response"><span class="line"><span class="version">HTTP</span> <span class="number">200</span></span> <span class="line"><span class="section-header">[Asserts]</span></span> <span class="line"><span class="query-type">jsonpath</span> <span class="string">"$.body"</span> <span class="predicate-type">matches</span> <span class="regex">/<img src="" onerror="alert('Hi!')">/</span></span> </span></span><span class="line"></span> </code></pre> The regex literal /<img src="" onerror="alert('Hi!')">/ is not escaped: <span class="regex">/<img src="" onerror="alert('Hi!')">/</span></span> When …