{"thread":{"id":"32804","subject":"Re: [PATCH] Verify Content-Type from smart HTTP servers","startedAt":"2013-01-31T22:36:14Z","lastAt":"2013-01-31T22:36:14Z","messageCount":1,"participants":["Shawn Pearce"],"isPatch":true,"patchVersion":1,"patchTotal":null},"messages":[{"id":"208419","messageId":"CAJo=hJusN5a37vPtw6dT0jMN7+VjvhTWFGB5b+z2cLCyAY3bzA@mail.gmail.com","threadId":"32804","inReplyTo":"7vd2wlf1zf.fsf@alter.siamese.dyndns.org","subject":"Re: [PATCH] Verify Content-Type from smart HTTP servers","fromName":"Shawn Pearce","fromEmail":"spearce@spearce.org","sentAt":"2013-01-31T22:36:14Z","receivedAt":"2013-01-31T22:36:14Z","isPatch":true,"sender":{"key":"spearce@spearce.org","avatar":"https://avatars.githubusercontent.com/u/34844?v=4"},"body":"On Thu, Jan 31, 2013 at 1:59 PM, Junio C Hamano <gitster@pobox.com> wrote:\n> Shawn Pearce <spearce@spearce.org> writes:\n>\n>> Before parsing a suspected smart-HTTP response verify the returned\n>> Content-Type matches the standard. This protects a client from\n>> attempting to process a payload that smells like a smart-HTTP\n>> server response.\n>>\n>> JGit has been doing this check on all responses since the dawn of\n>> time. I mistakenly failed to include it in git-core when smart HTTP\n>> was introduced. At the time I didn't know how to get the Content-Type\n>> from libcurl. I punted, meant to circle back and fix this, and just\n>> plain forgot about it.\n>>\n>> Signed-off-by: Shawn Pearce <spearce@spearce.org>\n>> ---\n>\n> Sounds sensible.  Was there a report of attack attempts by malicious\n> servers or something, or is it just a general \"common sense\" thing?\n\nCommon-sense cleanup.\n\nI had a report a while ago about JGit not working with the Git servers\nat Codeplex. This failure was caused by their HTTP servers returning\nan invalid Content-Type, making JGit refuse to continue parsing. This\nhas since been fixed, I verified this morning that Codeplex is\nreturning the correct Content-Type.\n"}]}