CURL_NETRC_REQUIRED sends the URL password when the .netrc file has no matching entry

How it was found

Summary

In required netrc mode (CURL_NETRC_REQUIRED, as set by --netrc or --netrc-file), the CURLOPT_NETRC documentation says any credential information present in the URL is ignored, but when the configured .netrc file loads successfully yet has no entry matching the requested host and username, libcurl keeps the password from the URL and sends it to the server as preemptive HTTP Basic authentication.

Affected version: curl/libcurl 8.23.0 and current git master (8.23.1-DEV, commit eabeacb9ff), macOS; 8.20.0 does not behave this way.

Steps To Reproduce:

# a .netrc that loads but has no entry for user 'alice'
printf 'machine example.com login bob password sekret\n' > nrc

# start any local HTTP server on 127.0.0.1:$PORT that logs request headers,
# then (required mode is implied by --netrc-file; URL carries user AND password):
curl -v --netrc-file nrc \
  --resolve example.com:$PORT:127.0.0.1 \
  "http://alice:[email protected]:$PORT/"

After the request goes out it carries Authorization: Basic YWxpY2U6c2VjcmV0 (base64 of alice:secret), so the URL password secret is transmitted even though required mode matched no .netrc entry.

Impact

An application that forwards externally supplied URLs to libcurl and selects required netrc mode specifically to stop URL-embedded credentials from being used would, when its .netrc has no matching entry, still send the URL password to that URL's host, contrary to the documented behavior. The scope is limited because the password is the one already present in the fetched URL and it is sent only to that same host, so no stored .netrc secret is exposed, credentials do not cross origins, and there is no server-side authentication bypass.