Re: [PATCH] Verify Content-Type from smart HTTP servers

[Michael Schubert <mschub@elegosoft.com>]

On 01/31/2013 11:09 PM, Junio C Hamano wrote:

>  
> -static int http_request_reauth(const char *url, void *result, int target,
> +static int http_request_reauth(const char *url,
> +			       struct strbuf *type,
> +			       void *result, int target,
>  			       int options)
>  {
> -	int ret = http_request(url, result, target, options);
> +	int ret = http_request(url, type, result, target, options);
>  	if (ret != HTTP_REAUTH)
>  		return ret;
> -	return http_request(url, result, target, options);
> +	return http_request(url, type, result, target, options);
>  }

This needs something like

diff --git a/http.c b/http.c
index d868d8b..da43be3 100644
--- a/http.c
+++ b/http.c
@@ -860,6 +860,8 @@ static int http_request_reauth(const char *url,
        int ret = http_request(url, type, result, target, options);
        if (ret != HTTP_REAUTH)
                return ret;
+       if (type)
+               strbuf_reset(type);
        return http_request(url, type, result, target, options);
 }

on top. Otherwise we get

"text/plainapplication/x-git-receive-pack-advertisement"

when doing HTTP auth.

Thanks.

> -int http_get_strbuf(const char *url, struct strbuf *result, int options)
> +int http_get_strbuf(const char *url,
> +		    struct strbuf *type,
> +		    struct strbuf *result, int options)
>  {
> -	return http_request_reauth(url, result, HTTP_REQUEST_STRBUF, options);
> +	return http_request_reauth(url, type, result,
> +				   HTTP_REQUEST_STRBUF, options);
>  }
>  
>  /*
> @@ -878,7 +891,7 @@ static int http_get_file(const char *url, const char *filename, int options)
>  		goto cleanup;
>  	}
>  
> -	ret = http_request_reauth(url, result, HTTP_REQUEST_FILE, options);
> +	ret = http_request_reauth(url, NULL, result, HTTP_REQUEST_FILE, options);
>  	fclose(result);
>  
>  	if ((ret == HTTP_OK) && move_temp_to_file(tmpfile.buf, filename))
> @@ -904,7 +917,7 @@ int http_fetch_ref(const char *base, struct ref *ref)
>  	int ret = -1;
>  
>  	url = quote_ref_url(base, ref->name);
> -	if (http_get_strbuf(url, &buffer, HTTP_NO_CACHE) == HTTP_OK) {
> +	if (http_get_strbuf(url, NULL, &buffer, HTTP_NO_CACHE) == HTTP_OK) {
>  		strbuf_rtrim(&buffer);
>  		if (buffer.len == 40)
>  			ret = get_sha1_hex(buffer.buf, ref->old_sha1);
> @@ -997,7 +1010,7 @@ int http_get_info_packs(const char *base_url, struct packed_git **packs_head)
>  	strbuf_addstr(&buf, "objects/info/packs");
>  	url = strbuf_detach(&buf, NULL);
>  
> -	ret = http_get_strbuf(url, &buf, HTTP_NO_CACHE);
> +	ret = http_get_strbuf(url, NULL, &buf, HTTP_NO_CACHE);
>  	if (ret != HTTP_OK)
>  		goto cleanup;
>  
> diff --git a/http.h b/http.h
> index 0a80d30..25d1931 100644
> --- a/http.h
> +++ b/http.h
> @@ -132,7 +132,7 @@ extern char *get_remote_object_url(const char *url, const char *hex,
>   *
>   * If the result pointer is NULL, a HTTP HEAD request is made instead of GET.
>   */
> -int http_get_strbuf(const char *url, struct strbuf *result, int options);
> +int http_get_strbuf(const char *url, struct strbuf *content_type, struct strbuf *result, int options);
>  
>  /*
>   * Prints an error message using error() containing url and curl_errorstr,
> diff --git a/remote-curl.c b/remote-curl.c
> index 9a8b123..e6f3b63 100644
> --- a/remote-curl.c
> +++ b/remote-curl.c
> @@ -92,6 +92,8 @@ static void free_discovery(struct discovery *d)
>  
>  static struct discovery* discover_refs(const char *service)
>  {
> +	struct strbuf exp = STRBUF_INIT;
> +	struct strbuf type = STRBUF_INIT;
>  	struct strbuf buffer = STRBUF_INIT;
>  	struct discovery *last = last_discovery;
>  	char *refs_url;
> @@ -113,7 +115,7 @@ static struct discovery* discover_refs(const char *service)
>  	}
>  	refs_url = strbuf_detach(&buffer, NULL);
>  
> -	http_ret = http_get_strbuf(refs_url, &buffer, HTTP_NO_CACHE);
> +	http_ret = http_get_strbuf(refs_url, &type, &buffer, HTTP_NO_CACHE);
>  	switch (http_ret) {
>  	case HTTP_OK:
>  		break;
> @@ -133,16 +135,19 @@ static struct discovery* discover_refs(const char *service)
>  	last->buf = last->buf_alloc;
>  
>  	if (maybe_smart && 5 <= last->len && last->buf[4] == '#') {
> -		/* smart HTTP response; validate that the service
> +		/*
> +		 * smart HTTP response; validate that the service
>  		 * pkt-line matches our request.
>  		 */
> -		struct strbuf exp = STRBUF_INIT;
> -
> +		strbuf_addf(&exp, "application/x-%s-advertisement", service);
> +		if (strbuf_cmp(&exp, &type))
> +			die("invalid content-type %s", type.buf);
>  		if (packet_get_line(&buffer, &last->buf, &last->len) <= 0)
>  			die("%s has invalid packet header", refs_url);
>  		if (buffer.len && buffer.buf[buffer.len - 1] == '\n')
>  			strbuf_setlen(&buffer, buffer.len - 1);
>  
> +		strbuf_reset(&exp);
>  		strbuf_addf(&exp, "# service=%s", service);
>  		if (strbuf_cmp(&exp, &buffer))
>  			die("invalid server response; got '%s'", buffer.buf);
> @@ -160,6 +165,8 @@ static struct discovery* discover_refs(const char *service)
>  	}
>  
>  	free(refs_url);
> +	strbuf_release(&exp);
> +	strbuf_release(&type);
>  	strbuf_release(&buffer);
>  	last_discovery = last;
>  	return last;