Nick Craig-Wood 59b513b0e7 webdav: fix HTTPS to HTTP redirects leaking credentials GHSA-h4mf-4v27-hggj ...

A server that redirects an HTTPS request to a plaintext HTTP URL on the
same host would cause Go's http.Client to replay the configured
credentials (Basic Authorization, cookies, secret headers) over the
network in cleartext.

Refuse to follow such downgrade redirects by default in lib/rest and wire
the webdav backend's client to use it. The `auth_redirect` option remains
the opt-in escape hatch for servers that legitimately need auth preserved
across redirects.

Fixes GHSA-h4mf-4v27-hggj

2026-07-31 13:21:59 +01:00

..

headers_test.go

backend/http: support content-range response header

2022-11-08 13:04:17 +00:00

headers.go

backend/http: support content-range response header

2022-11-08 13:04:17 +00:00

rest_test.go

webdav: fix HTTPS to HTTP redirects leaking credentials GHSA-h4mf-4v27-hggj

2026-07-31 13:21:59 +01:00

rest.go

webdav: fix HTTPS to HTTP redirects leaking credentials GHSA-h4mf-4v27-hggj

2026-07-31 13:21:59 +01:00

url_test.go

lib/rest: fix URLPathEscapeAll breaking WebDAV servers (eg nzbdav) with strict path matching

2026-03-12 21:58:22 +00:00

url.go

lib/rest: fix URLPathEscapeAll breaking WebDAV servers (eg nzbdav) with strict path matching

2026-03-12 21:58:22 +00:00