summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorBlake Burkhart <bburky@bburky.com>2015-09-22 22:06:20 (GMT)
committerJunio C Hamano <gitster@pobox.com>2015-09-25 22:32:28 (GMT)
commitb258116462399b318c86165c61a5c7123043cfd4 (patch)
tree0fab49f2d65cee265a23f3b95e84c57a0e38430f
parentf4113cac0c88b4f36ee6f3abf3218034440a68e3 (diff)
downloadgit-b258116462399b318c86165c61a5c7123043cfd4.zip
git-b258116462399b318c86165c61a5c7123043cfd4.tar.gz
git-b258116462399b318c86165c61a5c7123043cfd4.tar.bz2
http: limit redirection depth
By default, libcurl will follow circular http redirects forever. Let's put a cap on this so that somebody who can trigger an automated fetch of an arbitrary repository (e.g., for CI) cannot convince git to loop infinitely. The value chosen is 20, which is the same default that Firefox uses. Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com>
-rw-r--r--http.c1
-rw-r--r--t/lib-httpd/apache.conf3
-rwxr-xr-xt/t5812-proto-disable-http.sh4
3 files changed, 8 insertions, 0 deletions
diff --git a/http.c b/http.c
index 5a57bcc..00e3fc8 100644
--- a/http.c
+++ b/http.c
@@ -352,6 +352,7 @@ static CURL *get_curl_handle(void)
}
curl_easy_setopt(result, CURLOPT_FOLLOWLOCATION, 1);
+ curl_easy_setopt(result, CURLOPT_MAXREDIRS, 20);
#if LIBCURL_VERSION_NUM >= 0x071301
curl_easy_setopt(result, CURLOPT_POSTREDIR, CURL_REDIR_POST_ALL);
#elif LIBCURL_VERSION_NUM >= 0x071101
diff --git a/t/lib-httpd/apache.conf b/t/lib-httpd/apache.conf
index 68ef8ad..7d15e6d 100644
--- a/t/lib-httpd/apache.conf
+++ b/t/lib-httpd/apache.conf
@@ -121,6 +121,9 @@ RewriteRule ^/smart-redir-auth/(.*)$ /auth/smart/$1 [R=301]
RewriteRule ^/smart-redir-limited/(.*)/info/refs$ /smart/$1/info/refs [R=301]
RewriteRule ^/ftp-redir/(.*)$ ftp://localhost:1000/$1 [R=302]
+RewriteRule ^/loop-redir/x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-(.*) /$1 [R=302]
+RewriteRule ^/loop-redir/(.*)$ /loop-redir/x-$1 [R=302]
+
<IfDefine SSL>
LoadModule ssl_module modules/mod_ssl.so
diff --git a/t/t5812-proto-disable-http.sh b/t/t5812-proto-disable-http.sh
index 6a4f816..0d105d5 100755
--- a/t/t5812-proto-disable-http.sh
+++ b/t/t5812-proto-disable-http.sh
@@ -25,5 +25,9 @@ test_expect_success 'curl redirects respect whitelist' '
}
'
+test_expect_success 'curl limits redirects' '
+ test_must_fail git clone "$HTTPD_URL/loop-redir/smart/repo.git"
+'
+
stop_httpd
test_done