mirror of
https://github.com/rclone/rclone.git
synced 2026-10-28 14:28:38 -04:00
Nick Craig-Wood
30009599e4
Every file download sends the live account authorization token and, when configured, the SSE-C customer key headers to the download host. With --b2-download-url that host is a CDN or proxy the user does not operate, and the http client followed its redirects with Go's default policy: - Go only strips Authorization when the redirect target is not the same host or a subdomain, and never looks at the scheme, so a same-host HTTPS to HTTP redirect replayed the full-capability B2 token in cleartext. - Go has no idea that the X-Bz-Server-Side-Encryption-Customer-* headers carry the customer encryption key, so it forwarded them to any redirect target including a different host. The B2 client now uses rest.StripHeadersOnCrossHostRedirectFn, so it refuses to follow a redirect which downgrades HTTPS to HTTP and strips the Authorization and SSE-C headers from any redirect which leaves the host and port of the original request, matching the protection already given to the S3, WebDAV and HTTP backends. Fixes GHSA-gpw7-77cq-9f72