security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2024-06-07 23:27:48 +02:00
Code Activity
4a4bb874f6
gnupg/dirmngr
History
Werner Koch 4a4bb874f6
dirmngr: Avoid possible CSRF attacks via http redirects. 
* dirmngr/http.h (parsed_uri_s): Add fields off_host and off_path.
(http_redir_info_t): New.
* dirmngr/http.c (do_parse_uri): Set new fields.
(same_host_p): New.
(http_prepare_redirect): New.
* dirmngr/t-http-basic.c: New test.
* dirmngr/ks-engine-hkp.c (send_request): Use http_prepare_redirect
instead of the open code.
* dirmngr/ks-engine-http.c (ks_http_fetch): Ditto.
--

With this change a http query will not follow a redirect unless the
Location header gives the same host.  If the host is different only
the host and port is taken from the Location header and the original
path and query parts are kept.

Signed-off-by: Werner Koch <wk@gnupg.org>
(cherry picked from commit fa1b1eaa42)
2018-11-23 09:23:26 +01:00
..
cdb.h Tweaks for gpgconf. 2010-12-14 19:17:58 +00:00
cdblib.c g10, sm, dirmngr, common: Add comment for fall through. 2017-05-10 11:13:12 +09:00
certcache.c dirmngr: Implement CRL fetching via https. 2018-04-25 12:38:04 +02:00
certcache.h dirmngr: Use system certs if --hkp-cacert is not used. 2017-09-18 22:49:05 +02:00
ChangeLog-2011 Fix spelling. 2017-02-21 13:11:46 -05:00
ChangeLog-2011-ks Remove the obsolete keyserver directory from the repo. 2015-04-20 18:20:45 +02:00
crlcache.c dirmngr: Add FLUSHCRLs command 2018-11-12 12:42:03 +01:00
crlcache.h move some file encodings to UTF-8 2016-09-17 15:57:31 +09:00
crlfetch.c dirmngr: Allow redirection from https to http for CRLs 2018-04-25 12:38:04 +02:00
crlfetch.h Change all http://www.gnu.org in license notices to https:// 2016-11-05 12:02:19 +01:00
dirmngr_ldap.c dirmngr: Implement timeout for dirmngr_ldap under Windows. 2018-05-02 18:40:01 +02:00
dirmngr-client.c Fix usage of ARGPARSE_OPTS. 2017-07-19 13:41:18 +09:00
dirmngr-err.h Some work on porting dirmngr (unfinished) 2010-07-16 13:19:45 +00:00
dirmngr.c dirmngr: Only print info for no ldapserver file 2018-10-24 09:17:39 +02:00
dirmngr.h dirmngr: Add a background task framework. 2017-12-11 11:30:45 +01:00
dns-stuff.c dirmngr: Fix recursive resolver mode. 2018-06-18 17:23:31 +09:00
dns-stuff.h Spelling fixes in docs and comments. 2017-04-28 10:06:33 +09:00
dns.c libdns: For SOCKS connection, just fails. 2018-07-02 10:47:38 +09:00
dns.h dirmngr: New libdns snapshot 2016-12-14 15:56:58 +01:00
domaininfo.c dirmngr: Check for WKD support at session end 2017-12-11 11:31:15 +01:00
http-common.c dirmngr: Fix commit de6d8313 2017-03-03 17:17:26 +01:00
http-common.h dirmngr: Rearrange files to fix de6d831. 2017-03-02 18:35:03 +01:00
http-ntbtls.c dirmngr: Implement CRL fetching via https. 2018-04-25 12:38:04 +02:00
http.c dirmngr: Avoid possible CSRF attacks via http redirects. 2018-11-23 09:23:26 +01:00
http.h dirmngr: Avoid possible CSRF attacks via http redirects. 2018-11-23 09:23:26 +01:00
ks-action.c dirmngr: Allow redirection from https to http for CRLs 2018-04-25 12:38:04 +02:00
ks-action.h Change all http://www.gnu.org in license notices to https:// 2016-11-05 12:02:19 +01:00
ks-engine-finger.c dirmngr: Implement HTTP connect timeouts of 15 or 2 seconds. 2017-06-08 09:37:36 +02:00
ks-engine-hkp.c dirmngr: Avoid possible CSRF attacks via http redirects. 2018-11-23 09:23:26 +01:00
ks-engine-http.c dirmngr: Avoid possible CSRF attacks via http redirects. 2018-11-23 09:23:26 +01:00
ks-engine-kdns.c Remove -I option to common. 2017-03-07 20:25:54 +09:00
ks-engine-ldap.c dirmngr: Fix out of scope use of a var in the keyserver LDAP code. 2018-10-25 17:37:53 +02:00
ks-engine.h dirmngr: Allow redirection from https to http for CRLs 2018-04-25 12:38:04 +02:00
ldap-parse-uri.c Remove -I option to common. 2017-03-07 20:25:54 +09:00
ldap-parse-uri.h Remove -I option to common. 2017-03-07 20:25:54 +09:00
ldap-url.c dirmngr: Simplify strtok macro. 2014-03-07 19:00:31 +01:00
ldap-url.h Merged Dirmngr with GnuPG. 2010-06-09 16:53:51 +00:00
ldap-wrapper-ce.c dirmngr: Use the LDAP wrapper process also for Windows. 2018-04-27 12:05:31 +02:00
ldap-wrapper.c dirmngr: Sleep in the ldap wrapper thread. 2018-04-30 08:46:03 +02:00
ldap-wrapper.h Change all http://www.gnu.org in license notices to https:// 2016-11-05 12:02:19 +01:00
ldap.c dirmngr: Silence log output from dirmngr_ldap. 2018-04-27 11:57:08 +02:00
ldapserver.c Improve spelling and grammar of some comments. 2015-03-23 19:58:30 +01:00
ldapserver.h Change all http://www.gnu.org in license notices to https:// 2016-11-05 12:02:19 +01:00
loadswdb.c dirmngr: Allow redirection from https to http for CRLs 2018-04-25 12:38:04 +02:00
Makefile.am dirmngr: Avoid possible CSRF attacks via http redirects. 2018-11-23 09:23:26 +01:00
misc.c dirmngr: Fix LDAP port parsing. 2018-11-05 09:04:32 +01:00
misc.h dirmngr: Rearrange files to fix de6d831. 2017-03-02 18:35:03 +01:00
OAUTHORS Nuked almost all trailing white space. 2011-02-04 12:57:53 +01:00
ocsp.c dirmngr: In verbose mode print the OCSP responder id. 2018-11-05 09:19:39 +01:00
ocsp.h Merged Dirmngr with GnuPG. 2010-06-09 16:53:51 +00:00
ONEWS Nuked almost all trailing white space. 2011-02-04 12:57:53 +01:00
server.c dirmngr: Add FLUSHCRLs command 2018-11-12 12:42:03 +01:00
sks-keyservers.netCA.pem dirmngr: Add support for hkps keyservers. 2014-05-05 16:23:37 +02:00
t-dns-stuff.c Remove -I option to common. 2017-03-07 20:25:54 +09:00
t-http-basic.c dirmngr: Avoid possible CSRF attacks via http redirects. 2018-11-23 09:23:26 +01:00
t-http.c dirmngr: Avoid possible CSRF attacks via http redirects. 2018-11-23 09:23:26 +01:00
t-ldap-parse-uri.c Change all http://www.gnu.org in license notices to https:// 2016-11-05 12:02:19 +01:00
t-support.h Change all http://www.gnu.org in license notices to https:// 2016-11-05 12:02:19 +01:00
tls-ca.pem Move http module from common/ to dirmngr/. 2015-10-18 20:08:26 +02:00
validate.c Spelling fixes in docs and comments. 2017-04-28 10:06:33 +09:00
validate.h dirmngr: Add special treatment for the standard hkps pool to ntbtls. 2017-02-21 14:55:04 +01:00
w32-ldap-help.h Change all http://www.gnu.org in license notices to https:// 2016-11-05 12:02:19 +01:00
workqueue.c dirmngr: Add a background task framework. 2017-12-11 11:30:45 +01:00