# Re: [PATCH] Verify Content-Type from smart HTTP servers 1 messages from 2013-01-31 to 2013-01-31. Participants: Shawn Pearce. Thread: https://gitlist.dev/t/32804 ## Shawn Pearce, 2013-01-31 22:36 Subject: Re: [PATCH] Verify Content-Type from smart HTTP servers Message-ID: URL: https://gitlist.dev/e/CAJo%3DhJusN5a37vPtw6dT0jMN7%2BVjvhTWFGB5b%2Bz2cLCyAY3bzA%40mail.gmail.com In-Reply-To: <7vd2wlf1zf.fsf@alter.siamese.dyndns.org> ``` On Thu, Jan 31, 2013 at 1:59 PM, Junio C Hamano wrote: > Shawn Pearce writes: > >> Before parsing a suspected smart-HTTP response verify the returned >> Content-Type matches the standard. This protects a client from >> attempting to process a payload that smells like a smart-HTTP >> server response. >> >> JGit has been doing this check on all responses since the dawn of >> time. I mistakenly failed to include it in git-core when smart HTTP >> was introduced. At the time I didn't know how to get the Content-Type >> from libcurl. I punted, meant to circle back and fix this, and just >> plain forgot about it. >> >> Signed-off-by: Shawn Pearce >> --- > > Sounds sensible. Was there a report of attack attempts by malicious > servers or something, or is it just a general "common sense" thing? Common-sense cleanup. I had a report a while ago about JGit not working with the Git servers at Codeplex. This failure was caused by their HTTP servers returning an invalid Content-Type, making JGit refuse to continue parsing. This has since been fixed, I verified this morning that Codeplex is returning the correct Content-Type. ```