Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

allow 2 redirects for http client #1993

Merged
merged 2 commits into from
Dec 27, 2024
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion transport/httptransport/http_transport.go
Original file line number Diff line number Diff line change
Expand Up @@ -210,8 +210,12 @@ func (h *httpTransport) Execute(ctx context.Context, transportInfo []byte, dealI
} else {
// do not follow http redirects for security reasons
t.client = &http.Client{
// Custom CheckRedirect function to limit redirects
CheckRedirect: func(req *http.Request, via []*http.Request) error {
return http.ErrUseLastResponse
if len(via) >= 2 { // Limit to 2 redirects
return http.ErrUseLastResponse
}
return nil
},
}

Expand Down
12 changes: 9 additions & 3 deletions transport/httptransport/http_transport_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -387,8 +387,8 @@ func TestDownloadFromPrivateIPs(t *testing.T) {
}

func TestDontFollowHttpRedirects(t *testing.T) {
// we should not follow http redirects for security reasons. If the target URL tries to redirect, the client should return 303 response instead.
// This test sets up two servers, with one redirecting to the other. Without the redirect check the download would have been completed successfully.
// we should not follow more than 2 http redirects for security reasons. If the target URL tries to redirect, the client should return 303 response instead.
// This test sets up 3 servers, with one redirecting to the other. Without the redirect check the download would have been completed successfully.
rawSize := (100 * readBufferSize) + 30
ctx := context.Background()
st := newServerTest(t, rawSize)
Expand Down Expand Up @@ -422,8 +422,14 @@ func TestDontFollowHttpRedirects(t *testing.T) {
redirectSvr := httptest.NewServer(redirectHandler)
defer redirectSvr.Close()

var redirectHandler1 http.HandlerFunc = func(w http.ResponseWriter, r *http.Request) {
http.Redirect(w, r, redirectSvr.URL, http.StatusSeeOther)
}
redirectSvr1 := httptest.NewServer(redirectHandler1)
defer redirectSvr1.Close()

of := getTempFilePath(t)
th := executeTransfer(t, ctx, New(nil, newDealLogger(t, ctx), NChunksOpt(numChunks)), carSize, types.HttpRequest{URL: redirectSvr.URL}, of)
th := executeTransfer(t, ctx, New(nil, newDealLogger(t, ctx), NChunksOpt(numChunks)), carSize, types.HttpRequest{URL: redirectSvr1.URL}, of)
require.NotNil(t, th)

evts := waitForTransferComplete(th)
Expand Down
Loading