curl --continue-at confusion

How it was found

Summary:

When curl command is used with --continue-at, the --no-clobber is unexpectedly ignored and curl will append the output to the target file, even if it already exists. If --continue-at is used with--remove-on-error it can lead to unexpected removal of the file on early errors. Note that this also happens when combined with --remote-name and --remote-header-name.

Steps To Reproduce:

Tampering a file even if --no-clobber:

1. echo not to be touched > robots.txt
2. curl --no-clobber -C 1 -O https://curl.se/robots.txt

NOTE: Without -C 1 the output is written to robots.txt.<n>.

Deleting a file when combining --remove-on-error with --continue-at:

1. echo something > important
2. curl --remove-on-error -C 1 -o important https://nonexisting.curl.se/

NOTE: Without -C 1 the file is not removed.

Remediation

The easiest way to stop these issues from happening is to forbid use of --continue-at in combination with --no-clobber or --remove-on-error.

Impact

Unexpected modification or deletion of an existing file.