Nick Craig-Wood 79fbc0842f fshttp: don't send --header values to other hosts on redirect GHSA-486v-q2wf-fp2r CVE-PENDING ...

The headers set with --header and --header-download are added to
every request by the rclone transport, including redirect hops which
net/http makes to other hosts, so a credential passed with --header
for one host could be sent to any host that server chose to redirect
to.

The transport now walks the redirect chain net/http records on each
redirected request and, once the chain has visited a host other than
the one originally requested, removes the headers rather than adding
them.

Also restore the global --client-cert and --client-key config after
TestCertificates so its temporary files are not used by later tests.

(cherry picked from commit 101c3e342c86ae65c7c743474d7319330f0eb0ca)

2026-09-04 16:18:35 +01:00

..

dialer.go

config: make parsing of duration options consistent

2025-07-08 12:08:14 +02:00

dump_test.go

fshttp: add --dump trace to log connection level events via httptrace

2026-06-11 21:29:45 +01:00

http_test.go

fshttp: don't send --header values to other hosts on redirect GHSA-486v-q2wf-fp2r CVE-PENDING

2026-09-04 16:18:35 +01:00

http.go

fshttp: don't send --header values to other hosts on redirect GHSA-486v-q2wf-fp2r CVE-PENDING

2026-09-04 16:18:35 +01:00

prometheus.go

fshttp: add prometheus metrics for HTTP status code

2021-11-17 18:38:12 +03:00