From 9e2232ef726fc0f28cba733a77d717f7997f2cfd Mon Sep 17 00:00:00 2001
From: Bram Matthys <syzop@vulnscan.org>
Date: Sun, 9 Jul 2023 14:03:35 +0200
Subject: [PATCH] For DroneBL spam submissions use "Content-Type: text/xml".
 This also bumps the request size limit a bit.

---
 src/modules/spamreport.c |  1 +
 src/url_unreal.c         | 25 +++++++++++++++++++++++--
 2 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/src/modules/spamreport.c b/src/modules/spamreport.c
index a69144690..661ca6957 100644
--- a/src/modules/spamreport.c
+++ b/src/modules/spamreport.c
@@ -381,6 +381,7 @@ int _spamreport(Client *client, const char *ip, NameValuePrioList *details, cons
 		buildvarstring_nvp(fmtstring, bodybuf, sizeof(bodybuf), list, BUILDVARSTRING_XML|BUILDVARSTRING_UNKNOWN_VAR_IS_EMPTY);
 		body = bodybuf;
 		safe_free_nvplist(list); // frees all the duplicated lists
+		add_nvplist(&headers, 0, "Content-Type", "text/xml");
 	} else
 		abort();
 
diff --git a/src/url_unreal.c b/src/url_unreal.c
index 530ef1e72..4bcf7a2b9 100644
--- a/src/url_unreal.c
+++ b/src/url_unreal.c
@@ -510,7 +510,7 @@ int url_parse(const char *url, char **hostname, int *port, char **username, char
 
 void https_connect_send_header(Download *handle)
 {
-	char buf[1024];
+	char buf[8192];
 	char hostandport[512];
 	int ssl_err;
 	char *host;
@@ -543,15 +543,20 @@ void https_connect_send_header(Download *handle)
 					    VERSIONONLY,
 					    hostandport);
 		} else {
+			char add_default_content_type = 0;
+			if (!find_nvplist(handle->request_headers, "Content-Type"))
+				add_default_content_type = 1;
+
 			snprintf(buf, sizeof(buf), "POST %s HTTP/1.1\r\n"
 					    "User-Agent: UnrealIRCd %s\r\n"
 					    "Host: %s\r\n"
-					    "Content-Type: application/x-www-form-urlencoded\r\n"
+					    "%s"
 					    "Content-Length: %ld\r\n"
 					    "Connection: close\r\n",
 					    handle->document,
 					    VERSIONONLY,
 					    hostandport,
+					    add_default_content_type ? "Content-Type: application/x-www-form-urlencoded\r\n" : "",
 					    strlen(handle->body));
 		}
 	} else
@@ -579,6 +584,22 @@ void https_connect_send_header(Download *handle)
 				 "If-Modified-Since: %s\r\n", datestr);
 		}
 	}
+	if (handle->request_headers)
+	{
+		NameValuePrioList *n;
+		char nbuf[256];
+
+		for (n = handle->request_headers; n; n = n->next)
+		{
+			if (n->value)
+				snprintf(nbuf, sizeof(nbuf), "%s: %s\r\n", n->name, n->value);
+			else
+				snprintf(nbuf, sizeof(nbuf), "%s:\r\n", n->name);
+			if (strlen(buf)+strlen(nbuf) > sizeof(buf)-8)
+				break;
+			strlcat(buf, nbuf, sizeof(buf));
+		}
+	}
 	strlcat(buf, "\r\n", sizeof(buf));
 	if (handle->body)
 		strlcat(buf, handle->body, sizeof(buf));