unofficial mirror of bug-gnu-emacs@gnu.org 
 help / color / mirror / code / Atom feed
From: Lars Ingebrigtsen <larsi@gnus.org>
To: Romain Ouabdelkader <romain.ouabdelkader@gmail.com>
Cc: 37187@debbugs.gnu.org, Thomas Fitzsimmons <fitzsim@fitzsim.org>
Subject: bug#37187: 26.2; url-retrieve redirect lost Authorization headers
Date: Sat, 21 Sep 2019 09:41:22 +0200	[thread overview]
Message-ID: <87ftkq2j19.fsf@gnus.org> (raw)
In-Reply-To: <CAJ8YToYw9iDOUXXZoh2K9VG1+nEPNjLCi_MwC0kSzUd5Er-fUg@mail.gmail.com> (Romain Ouabdelkader's message of "Sat, 21 Sep 2019 02:01:24 +0200")

Romain Ouabdelkader <romain.ouabdelkader@gmail.com> writes:

> Indeed, curl does the same thing:
> https://curl.haxx.se/docs/CVE-2018-1000007.html
>
> But it seems to only strip the Authorization header if the redirect is on 
> another host:
>
> https://github.com/curl/curl/commit/af32cd3859336ab.patch

Right.  But Thomas seems to imply in Bug#21350 that url.el will
determine when doing the redirected call whether to include auth again,
so if that new URL requires auth, then it'll be regenerated at that
point.

Is that not the case?

-- 
(domestic pets only, the antidote for overdose, milk.)
   bloggy blog: http://lars.ingebrigtsen.no





  reply	other threads:[~2019-09-21  7:41 UTC|newest]

Thread overview: 8+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-08-25 22:08 bug#37187: 26.2; url-retrieve redirect lost Authorization headers Romain Ouabdelkader
2019-09-20 20:36 ` Lars Ingebrigtsen
2019-09-21  0:01   ` Romain Ouabdelkader
2019-09-21  7:41     ` Lars Ingebrigtsen [this message]
2019-09-21  8:26       ` Romain Ouabdelkader
2019-09-21  8:40         ` Lars Ingebrigtsen
2019-09-21  9:27           ` Romain Ouabdelkader
2020-07-19 20:24             ` Lars Ingebrigtsen

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

  List information: https://www.gnu.org/software/emacs/

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=87ftkq2j19.fsf@gnus.org \
    --to=larsi@gnus.org \
    --cc=37187@debbugs.gnu.org \
    --cc=fitzsim@fitzsim.org \
    --cc=romain.ouabdelkader@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
Code repositories for project(s) associated with this public inbox

	https://git.savannah.gnu.org/cgit/emacs.git

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).