diff mbox series

debuginfod-client: Stick to http:// + https:// + file:// protocols

Message ID 20211015132548.10058-1-mark@klomp.org
State Committed
Headers
Series debuginfod-client: Stick to http:// + https:// + file:// protocols |

Commit Message

Mark Wielaard Oct. 15, 2021, 1:25 p.m. UTC 
  Make sure we don't use any of the more experimental protocols
libcurl might support. URLs can be redirected and we might want
to follow http -> https, but not e.g. gopher or pop3.

Suggested-by: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>
Signed-off-by: Mark Wielaard <mark@klomp.org>
---
 debuginfod/ChangeLog           | 5 +++++
 debuginfod/debuginfod-client.c | 4 ++++
 2 files changed, 9 insertions(+)

Comments

Mark Wielaard Oct. 18, 2021, 11:35 a.m. UTC | #1 
Hi,

On Fri, 2021-10-15 at 15:25 +0200, Mark Wielaard wrote:
> Make sure we don't use any of the more experimental protocols
> libcurl might support. URLs can be redirected and we might want
> to follow http -> https, but not e.g. gopher or pop3.

On irc Frank said he didn't have any objections to this, so pushed.

Cheers,

Mark
diff mbox series

Patch

diff --git a/debuginfod/ChangeLog b/debuginfod/ChangeLog
index de833f7f..a91749e7 100644
--- a/debuginfod/ChangeLog
+++ b/debuginfod/ChangeLog
@@ -1,3 +1,8 @@ 
+2021-10-15  Mark Wielaard  <mark@klomp.org>
+
+	* debuginfod-client.c (debuginfod_query_server): Set
+	CURLOPT_PROTOCOLS.
+
 2021-10-06  Di Chen <dichen@redhat.com>
 
 	PR28242
diff --git a/debuginfod/debuginfod-client.c b/debuginfod/debuginfod-client.c
index 88e45567..bd947ae4 100644
--- a/debuginfod/debuginfod-client.c
+++ b/debuginfod/debuginfod-client.c
@@ -973,6 +973,10 @@  debuginfod_query_server (debuginfod_client *c,
       if (vfd >= 0)
 	dprintf (vfd, "url %d %s\n", i, data[i].url);
 
+      /* Only allow http:// + https:// + file:// so we aren't being
+	 redirected to some unsupported protocol.  */
+      curl_easy_setopt(data[i].handle, CURLOPT_PROTOCOLS,
+		       CURLPROTO_HTTP | CURLPROTO_HTTPS | CURLPROTO_FILE);
       curl_easy_setopt(data[i].handle, CURLOPT_URL, data[i].url);
       if (vfd >= 0)
 	curl_easy_setopt(data[i].handle, CURLOPT_ERRORBUFFER, data[i].errbuf);