Re: [PATCH] Verify Content-Type from smart HTTP servers

From: Shawn Pearce <spearce@spearce.org>
Date: Jan 31, 2013, 22:36 UTC
Message-ID: <CAJo=hJusN5a37vPtw6dT0jMN7+VjvhTWFGB5b+z2cLCyAY3bzA@mail.gmail.com>
In-Reply-To: <7vd2wlf1zf.fsf@alter.siamese.dyndns.org>

On Thu, Jan 31, 2013 at 1:59 PM, Junio C Hamano <gitster@pobox.com> wrote:

Show 18 quoted lines

> Shawn Pearce <spearce@spearce.org> writes:
>
>> Before parsing a suspected smart-HTTP response verify the returned
>> Content-Type matches the standard. This protects a client from
>> attempting to process a payload that smells like a smart-HTTP
>> server response.
>>
>> JGit has been doing this check on all responses since the dawn of
>> time. I mistakenly failed to include it in git-core when smart HTTP
>> was introduced. At the time I didn't know how to get the Content-Type
>> from libcurl. I punted, meant to circle back and fix this, and just
>> plain forgot about it.
>>
>> Signed-off-by: Shawn Pearce <spearce@spearce.org>
>> ---
>
> Sounds sensible.  Was there a report of attack attempts by malicious
> servers or something, or is it just a general "common sense" thing?

Common-sense cleanup.

I had a report a while ago about JGit not working with the Git servers at Codeplex. This failure was caused by their HTTP servers returning an invalid Content-Type, making JGit refuse to continue parsing. This has since been fixed, I verified this morning that Codeplex is returning the correct Content-Type.