Artifact [29e8b9ab5f]

Artifact 29e8b9ab5f9b1097542f69deb882ead298a82ad600e29d1e7e1fda16b5f885ce:

• File internal/sync/redirect.go — part of check-in [3a1014cf60] at 2026-10-11 13:28:30 on branch trunk — fix(sync): send content only to readers; never follow HTTPS to HTTP (security) (#297)

  * fix(sync): send content only to requesters allowed to read it

  The sync server answered `gimme HASH` with the artifact whether or not a pull card had been accepted, and answered `pragma uv-hash`, `uvgimme` and `uvigot` with the unversioned catalog and files for any requester, anonymous ones included.

  Match fossil's page_xfer:

  - gimme is answered only when a pull card was accepted, or in a clone, which fossil also treats as pulling. - pragma uv-hash sends the catalog only to a requester with Read (o, i or Admin). uv-push-ok goes only to a requester with y; other readers get uv-pull-only, as fossil sends. - uvgimme and uvigot send nothing to a requester without Read, and uvigot adopts a client's mtime only for a requester with y. - Table sync follows the same rules: xgimme needs an accepted pull and pragma xtable-hash needs Read. - pragma ci-lock takes or reports a lock only for a requester with Write, so an anonymous requester cannot learn who holds one.

  Pragma handling moves into handlePragma to keep handleControlCard short.

  GHSA-mvx3-6793-8x4r

  * docs(changelog): note that gating ci-lock on Write departs from fossil

  GHSA-mvx3-6793-8x4r

  * fix(sync): follow HTTP redirects as fossil does, never HTTPS to HTTP

  Both HTTP transports used net/http's default redirect policy. It follows a redirect from HTTPS to plain HTTP, so a 307 or 308 resent the request, login card included, in cleartext. It also turns a 301 or 302 into a GET without the body and stops after 10 redirects, neither of which fossil does.

  PostXfer now follows redirects the way fossil's http_exchange (src/http.c) and draft §4 describe. It replaces the client's redirect policy for these requests, then:

  - refuses a redirect from HTTPS to HTTP, and to any scheme but http(s); - re-POSTs the same body and Content-Type for 301, 302, 307 and 308; - strips one trailing /xfer from the new location, as fossil's loop does (the draft says "repeatedly"; the code strips once); - fails on the twentieth redirect (MAX_REDIRECTS 20).

  HTTPTransport and NewHTTPTransport both use it, including with a client passed through WithHTTPClient.

  GHSA-3f8x-8fr5-mr98 (user: [email protected], size: 3400) [annotate] [blame] [check-ins using]

package sync

import (
	"bytes"
	"context"
	"errors"
	"fmt"
	"io"
	"net/http"
	"net/url"
	"strings"
)

// maxRedirects is fossil's MAX_REDIRECTS (src/xfer.c). http_exchange
// decrements it on each redirect and fails when it reaches zero, so 19
// redirects are followed and the twentieth is fatal (draft §4).
const maxRedirects = 20

// ErrRedirectDowngrade reports a redirect from HTTPS to plain HTTP. Following
// it would resend the request, login card included, in cleartext.
var ErrRedirectDowngrade = errors.New("sync: cannot redirect from HTTPS to HTTP")

// ErrRedirectLimit reports a twentieth redirect.
var ErrRedirectLimit = errors.New("sync: redirect limit exceeded")

// PostXfer POSTs body to target and follows redirects as fossil's
// http_exchange does (src/http.c), not as net/http does. net/http turns a 301
// or 302 into a GET without the body, follows a downgrade from HTTPS to HTTP,
// and stops after 10. Fossil re-POSTs the same body for 301, 302, 307 and
// 308, strips a trailing /xfer from the new location, refuses a downgrade,
// and fails on the twentieth redirect.
//
// The client's own redirect policy is replaced for these requests only, so
// a caller's client is used as given but cannot loosen these rules. A redirect
// without a Location is returned as is, for the caller to report its status.
func PostXfer(ctx context.Context, client *http.Client, target, contentType string,
	body []byte) (*http.Response, error) {
	if client == nil {
		panic("sync.PostXfer: client must not be nil")
	}
	c := *client
	c.CheckRedirect = func(*http.Request, []*http.Request) error {
		return http.ErrUseLastResponse
	}
	for left := maxRedirects; ; {
		req, err := http.NewRequestWithContext(ctx, http.MethodPost, target,
			bytes.NewReader(body))
		if err != nil {
			return nil, err
		}
		req.Header.Set("Content-Type", contentType)
		resp, err := c.Do(req)
		if err != nil {
			return nil, err
		}
		loc := resp.Header.Get("Location")
		if !isFollowedRedirect(resp.StatusCode) || loc == "" {
			return resp, nil
		}
		// Drain a little so the connection can be reused, then let it go.
		io.Copy(io.Discard, io.LimitReader(resp.Body, 4096))
		resp.Body.Close()
		left--
		if left == 0 {
			return nil, ErrRedirectLimit
		}
		if target, err = redirectTarget(target, loc); err != nil {
			return nil, err
		}
	}
}

func isFollowedRedirect(code int) bool {
	switch code {
	case http.StatusMovedPermanently, http.StatusFound,
		http.StatusTemporaryRedirect, http.StatusPermanentRedirect:
		return true
	}
	return false
}

// redirectTarget resolves loc against from and applies fossil's rules to it.
// Fossil strips one trailing /xfer, though draft §4 says "repeatedly": its
// loop truncates the string at the match, after which the substring it
// compares is four characters long and can never equal "/xfer" again.
func redirectTarget(from, loc string) (string, error) {
	base, err := url.Parse(from)
	if err != nil {
		return "", fmt.Errorf("sync: redirect from %q: %w", from, err)
	}
	next, err := base.Parse(loc)
	if err != nil {
		return "", fmt.Errorf("sync: malformed redirect %q: %w", loc, err)
	}
	if next.Scheme != "http" && next.Scheme != "https" {
		return "", fmt.Errorf("sync: cannot redirect to %q", loc)
	}
	if base.Scheme == "https" && next.Scheme == "http" {
		return "", ErrRedirectDowngrade
	}
	return strings.TrimSuffix(next.String(), "/xfer"), nil
}