From: Junio C Hamano <gitster@pobox.com>
To: Jeff King <peff@peff.net>
Cc: git@vger.kernel.org, slonkazoid <slonkazoid@slonk.ing>
Subject: Re: [PATCH] http: handle absolute-path alternates from server root
Date: Wed, 13 May 2026 10:10:54 +0900 [thread overview]
Message-ID: <xmqqo6ikjeqp.fsf@gitster.g> (raw)
In-Reply-To: <20260512162619.GA69813@coredump.intra.peff.net> (Jeff King's message of "Tue, 12 May 2026 12:26:19 -0400")
Jeff King <peff@peff.net> writes:
> ... Probably in a way that makes it totally invalid, but
> if you were very unlucky you could turn something like:
>
> http://victim.com.evil.domain:8000
>
> into:
>
> http://victim.com
>
> Which looks like the start of a redirect attack, except that
> the attacker could just have written "http://victim.com" in
> the first place! Either way we feed it to
> is_alternate_allowed(), which is where we check redirect and
> protocol rules.
Yuck. I know I am the guilty party who introduced the dumb HTTP
walker but I wish we could kill it off after all these years. I did
not even recall that we supported the alternate object store in the
"protocol" until I saw this patch X-<.
> I think we can just treat this like a regular bug.
Absolutely. Thanks.
next prev parent reply other threads:[~2026-05-13 1:10 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-05-12 16:26 [PATCH] http: handle absolute-path alternates from server root Jeff King
2026-05-13 1:10 ` Junio C Hamano [this message]
2026-05-13 18:58 ` Jeff King
2026-05-15 7:41 ` Patrick Steinhardt
2026-05-15 17:01 ` Jeff King
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=xmqqo6ikjeqp.fsf@gitster.g \
--to=gitster@pobox.com \
--cc=git@vger.kernel.org \
--cc=peff@peff.net \
--cc=slonkazoid@slonk.ing \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox