Nick Craig-Wood e7d4d425bc http: stop a path starting with // moving the remote to another host GHSA-xqmq-v4wj-rw5m CVE-PENDING ...

The http backend resolves the path after `remote:` against the
configured url according to the URL standard. A path beginning with
`//` is a network-path reference under that standard, so a path such as
`//other.example/dir/` replaced the configured host (and port and
userinfo) rather than being treated as a path. The configured headers
were then sent to the substituted host on the initial HEAD request and
every request after it.

Use rest.URLJoinRoot, which refuses any root carrying a scheme, host
or userinfo of its own, to join the path onto the configured url.

(cherry picked from commit ecd821243f)

2026-10-09 00:01:35 +01:00

..

test

http: add basic metadata and provide it via serve

2025-11-17 16:52:30 +00:00

http_internal_test.go

http: stop a path starting with // moving the remote to another host GHSA-xqmq-v4wj-rw5m CVE-PENDING

2026-10-09 00:01:35 +01:00

http.go

http: stop a path starting with // moving the remote to another host GHSA-xqmq-v4wj-rw5m CVE-PENDING

2026-10-09 00:01:35 +01:00