security-and-privacy/gnupg
security-and-privacy
/
gnupg
mirror of git://git.gnupg.org/gnupg.git
1
0
Fork 0
Code Releases Activity
gnupg/dirmngr
History
Werner Koch fa1b1eaa42
dirmngr: Avoid possible CSRF attacks via http redirects. 
* dirmngr/http.h (parsed_uri_s): Add fields off_host and off_path.
(http_redir_info_t): New.
* dirmngr/http.c (do_parse_uri): Set new fields.
(same_host_p): New.
(http_prepare_redirect): New.
* dirmngr/t-http-basic.c: New test.
* dirmngr/ks-engine-hkp.c (send_request): Use http_prepare_redirect
instead of the open code.
* dirmngr/ks-engine-http.c (ks_http_fetch): Ditto.
--

With this change a http query will not follow a redirect unless the
Location header gives the same host.  If the host is different only
the host and port is taken from the Location header and the original
path and query parts are kept.

Signed-off-by: Werner Koch <wk@gnupg.org>
 		2018-11-22 22:36:07 +01:00
..
ChangeLog-2011 Fix spelling. 2017-02-21 13:11:46 -05:00
ChangeLog-2011-ks Remove the obsolete keyserver directory from the repo. 2015-04-20 18:20:45 +02:00
Makefile.am dirmngr: Avoid possible CSRF attacks via http redirects. 2018-11-22 22:36:07 +01:00
OAUTHORS Nuked almost all trailing white space. 2011-02-04 12:57:53 +01:00
ONEWS Nuked almost all trailing white space. 2011-02-04 12:57:53 +01:00
cdb.h headers: fix spelling 2018-10-25 16:53:05 -04:00
cdblib.c all: fix spelling and typos 2018-10-24 15:56:18 -04:00
certcache.c dirmngr: Implement CRL fetching via https. 2018-04-25 12:38:04 +02:00
certcache.h dirmngr: Use system certs if --hkp-cacert is not used. 2017-09-18 22:49:05 +02:00
crlcache.c dirmngr: Add FLUSHCRLs command 2018-11-12 13:54:26 +01:00
crlcache.h move some file encodings to UTF-8 2016-09-17 15:57:31 +09:00
crlfetch.c dirmngr: Allow redirection from https to http for CRLs 2018-04-25 12:38:04 +02:00
crlfetch.h Change all http://www.gnu.org in license notices to https:// 2016-11-05 12:02:19 +01:00
dirmngr-client.c Fix usage of ARGPARSE_OPTS. 2017-07-19 13:41:18 +09:00
dirmngr-err.h Some work on porting dirmngr (unfinished) 2010-07-16 13:19:45 +00:00
dirmngr-status.h dirmngr: Print a WARNING status for DNS config problems. 2018-07-25 14:35:04 +02:00
dirmngr.c all: fix spelling and typos 2018-10-24 15:56:18 -04:00
dirmngr.h dirmngr: Serialize access to hosttable. 2018-09-11 14:02:53 +09:00
dirmngr_ldap.c all: fix spelling and typos 2018-10-24 15:56:18 -04:00
dns-stuff.c dirmngr: Support the new WKD draft with the openpgpkey subdomain. 2018-11-13 11:35:39 +01:00
dns-stuff.h dirmngr: Print a WARNING status for DNS config problems. 2018-07-25 14:35:04 +02:00
dns.c all: fix spelling and typos 2018-10-24 15:56:18 -04:00
dns.h dirmngr: New libdns snapshot 2016-12-14 15:56:58 +01:00
domaininfo.c dirmngr: Support the new WKD draft with the openpgpkey subdomain. 2018-11-13 11:35:39 +01:00
http-common.c dirmngr: Fix commit de6d8313 2017-03-03 17:17:26 +01:00
http-common.h dirmngr: Rearrange files to fix de6d831. 2017-03-02 18:35:03 +01:00
http-ntbtls.c all: fix spelling and typos 2018-10-24 15:56:18 -04:00
http.c dirmngr: Avoid possible CSRF attacks via http redirects. 2018-11-22 22:36:07 +01:00
http.h dirmngr: Avoid possible CSRF attacks via http redirects. 2018-11-22 22:36:07 +01:00
ks-action.c all: fix spelling and typos 2018-10-24 15:56:18 -04:00
ks-action.h Change all http://www.gnu.org in license notices to https:// 2016-11-05 12:02:19 +01:00
ks-engine-finger.c dirmngr: Print a WARNING status for DNS config problems. 2018-07-25 14:35:04 +02:00
ks-engine-hkp.c dirmngr: Avoid possible CSRF attacks via http redirects. 2018-11-22 22:36:07 +01:00
ks-engine-http.c dirmngr: Avoid possible CSRF attacks via http redirects. 2018-11-22 22:36:07 +01:00
ks-engine-kdns.c Remove -I option to common. 2017-03-07 20:25:54 +09:00
ks-engine-ldap.c dirmngr: Fix out of scope use of a var in the keyserver LDAP code. 2018-10-25 17:34:24 +02:00
ks-engine.h dirmngr: Allow redirection from https to http for CRLs 2018-04-25 12:38:04 +02:00
ldap-parse-uri.c Remove -I option to common. 2017-03-07 20:25:54 +09:00
ldap-parse-uri.h Remove -I option to common. 2017-03-07 20:25:54 +09:00
ldap-url.c dirmngr: Simplify strtok macro. 2014-03-07 19:00:31 +01:00
ldap-url.h Merged Dirmngr with GnuPG. 2010-06-09 16:53:51 +00:00
ldap-wrapper-ce.c dirmngr: Use the LDAP wrapper process also for Windows. 2018-04-27 12:05:31 +02:00
ldap-wrapper.c dirmngr: Sleep in the ldap wrapper thread. 2018-04-30 08:46:03 +02:00
ldap-wrapper.h Change all http://www.gnu.org in license notices to https:// 2016-11-05 12:02:19 +01:00
ldap.c all: fix spelling and typos 2018-10-24 15:56:18 -04:00
ldapserver.c Improve spelling and grammar of some comments. 2015-03-23 19:58:30 +01:00
ldapserver.h Change all http://www.gnu.org in license notices to https:// 2016-11-05 12:02:19 +01:00
loadswdb.c dirmngr: Allow redirection from https to http for CRLs 2018-04-25 12:38:04 +02:00
misc.c dirmngr: Fix LDAP port parsing. 2018-11-05 09:00:02 +01:00
misc.h dirmngr: Rearrange files to fix de6d831. 2017-03-02 18:35:03 +01:00
ocsp.c all: fix spelling and typos 2018-10-24 15:56:18 -04:00
ocsp.h Merged Dirmngr with GnuPG. 2010-06-09 16:53:51 +00:00
server.c dirmngr: Support the new WKD draft with the openpgpkey subdomain. 2018-11-13 11:35:39 +01:00
sks-keyservers.netCA.pem dirmngr: Add support for hkps keyservers. 2014-05-05 16:23:37 +02:00
t-dns-stuff.c dirmngr: Print a WARNING status for DNS config problems. 2018-07-25 14:35:04 +02:00
t-http-basic.c dirmngr: Avoid possible CSRF attacks via http redirects. 2018-11-22 22:36:07 +01:00
t-http.c dirmngr: Avoid possible CSRF attacks via http redirects. 2018-11-22 22:36:07 +01:00
t-ldap-parse-uri.c Change all http://www.gnu.org in license notices to https:// 2016-11-05 12:02:19 +01:00
t-support.c dirmngr: Print a WARNING status for DNS config problems. 2018-07-25 14:35:04 +02:00
t-support.h Change all http://www.gnu.org in license notices to https:// 2016-11-05 12:02:19 +01:00
tls-ca.pem Move http module from common/ to dirmngr/. 2015-10-18 20:08:26 +02:00
validate.c Spelling fixes in docs and comments. 2017-04-28 10:06:33 +09:00
validate.h dirmngr: Add special treatment for the standard hkps pool to ntbtls. 2017-02-21 14:55:04 +01:00
w32-ldap-help.h Change all http://www.gnu.org in license notices to https:// 2016-11-05 12:02:19 +01:00
workqueue.c all: fix spelling and typos 2018-10-24 15:56:18 -04:00