git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [PATCH 4/6] http: make redirects more obvious

From
Ramsay Jones <ramsay@ramsayjones.plus.com>
Date
Dec 1, 2016, 16:06 UTC
Message-ID
<5a47c032-755d-ad11-390f-22ae19ca584a@ramsayjones.plus.com>
In-Reply-To
<20161201090428.pweq7slwujbne5hg@sigill.intra.peff.net>
On 01/12/16 09:04, Jeff King wrote:
Show 5 quoted lines
> We instruct curl to always follow HTTP redirects. This is
> convenient, but it creates opportunities for malicious
> servers to create confusing situations. For instance,
> imagine Alice is a git user with access to a private
> repository on Bob's server. Mallory runs her own server and
Ahem, so Mallory is female? (-blush-) :(

ATB, Ramsay Jones

Previous: Jeff KingNext: Jeff King
Message 14 of 18 in “restricting http redirects”
  1. 0/6 restricting http redirectsJeff King, Dec 1, 2016
  2. 3/6 remote-curl: rename shadowed options variableJeff King, Dec 1, 2016
  3. 1/6 http: simplify update_url_from_redirectJeff King, Dec 1, 2016
  4. 2/6 http: always update the base URL for redirectsJeff King, Dec 1, 2016
  5. Ramsay JonesDec 1, 2016
  6. Brandon WilliamsDec 1, 2016
  7. Philip OakleyDec 1, 2016
  8. Junio C HamanoDec 1, 2016
  9. Ramsay JonesDec 2, 2016
  10. Jeff KingDec 2, 2016
  11. Ramsay JonesDec 2, 2016
  12. 6/6 http-walker: complain about non-404 loose object errorsJeff King, Dec 1, 2016
  13. 4/6 http: make redirects more obviousJeff King, Dec 1, 2016
  14. Ramsay JonesDec 1, 2016
  15. 5/6 http: treat http-alternates like redirectsJeff King, Dec 1, 2016
  16. Brandon WilliamsDec 1, 2016
  17. Jeff KingDec 2, 2016
  18. Jeff KingDec 5, 2016

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.