diff options
| author | Werner Koch <[email protected]> | 2023-06-15 13:06:21 +0000 |
|---|---|---|
| committer | Werner Koch <[email protected]> | 2023-06-15 13:06:21 +0000 |
| commit | 0a63afc79a0466a0554870d5e8aa6c3d8a048b3d (patch) | |
| tree | 2988d4d14c24bdfeb3293f52a5f22e240ea49b94 /dirmngr/http.c | |
| parent | dirmngr: New option --compatibility-flags. (diff) | |
| download | gnupg-0a63afc79a0466a0554870d5e8aa6c3d8a048b3d.tar.gz gnupg-0a63afc79a0466a0554870d5e8aa6c3d8a048b3d.zip | |
dirmngr: Disable the HTTP redirect rewriting.
* dirmngr/http.h (struct http_redir_info_s): Add restrict_redir.
* dirmngr/ks-engine-hkp.c (send_request): Set it depending on flags.
* dirmngr/ks-engine-http.c (ks_http_fetch): Ditto.
* dirmngr/t-http-basic.c (test_http_prepare_redirect): Always set it.
* dirmngr/http.c (http_prepare_redirect): Remove location rewriting
unless the flag is set.
--
GnuPG-bug-id: 6477
Diffstat (limited to 'dirmngr/http.c')
| -rw-r--r-- | dirmngr/http.c | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/dirmngr/http.c b/dirmngr/http.c index b4c501736..8153fcef4 100644 --- a/dirmngr/http.c +++ b/dirmngr/http.c @@ -3741,10 +3741,11 @@ http_prepare_redirect (http_redir_info_t *info, unsigned int status_code, http_release_parsed_uri (locuri); return err; } - else if (same_host_p (origuri, locuri)) + else if (!info->restrict_redir || same_host_p (origuri, locuri)) { - /* The host is the same or on an exception list and thus we can - * take the location verbatim. */ + /* Take the syntactically correct location or if restrict_redir + * is set the host is the same or on an exception list and thus + * we can take the location verbatim. */ http_release_parsed_uri (origuri); http_release_parsed_uri (locuri); newurl = xtrystrdup (location); @@ -3754,7 +3755,7 @@ http_prepare_redirect (http_redir_info_t *info, unsigned int status_code, return err; } } - else + else /* Strictly rectricted redirection which we used in the past. */ { /* We take only the host and port from the URL given in the * Location. This limits the effects of redirection attacks by |