Nick Craig-Wood 3760671b36 pcloud: only accept pCloud hosts from the hostname in the OAuth callback ...

When pCloud redirects the browser back to rclone's local OAuth
callback server it adds a `hostname` parameter saying which regional
API host (api.pcloud.com or eapi.pcloud.com) the account lives on.
rclone used this for the token exchange and saved it in the config as
the host for all of the remote's later traffic, without checking it.

This only accepts a well formed hostname within pCloud's own domain,
lower cased, failing the config with an error otherwise, and adds a
unit test for the check. This is defence in depth for GHSA-hvpr-p4pv-4f46

2026-10-08 22:49:33 +01:00

..

api

pcloud: add support for real-time updates in mount

2025-12-17 15:13:25 +00:00

pcloud_internal_test.go

pcloud: only accept pCloud hosts from the hostname in the OAuth callback

2026-10-08 22:49:33 +01:00

pcloud_test.go

build: fix up package paths after repo move

2019-07-28 18:47:38 +01:00

pcloud.go

pcloud: only accept pCloud hosts from the hostname in the OAuth callback

2026-10-08 22:49:33 +01:00

writer_at.go

build: modernize Go usage

2025-02-28 11:31:14 +00:00