49b9ccfc62
1.0.3:
* Fixed CVE-2019-10751 — the way the output filename is generated for
--download requests without --output resulting in a redirect has
been changed to only consider the initial URL as the base for the generated
filename, and not the final one. This fixes a potential security issue under
the following scenario:
1. A --download request with no explicit --output is made (e.g.,
$ http -d example.org/file.txt), instructing httpie to
generate the output filename <https://httpie.org/doc#downloaded-file-name>_
from the Content-Disposition response, or from the URL if the header
is not provided.
2. The server handling the request has been modified by an attacker and
instead of the expected response the URL returns a redirect to another
URL, e.g., attacker.example.org/.bash_profile, whose response does
not provide a Content-Disposition header (i.e., the base for the
generated filename becomes .bash_profile instead of file.txt).
3. Your current directory doesn’t already contain .bash_profile
(i.e., no unique suffix is added to the generated filename).
4. You don’t notice the potentially unexpected output filename
as reported by httpie in the console output
(e.g., Downloading 100.00 B to ".bash_profile").
6 lines
399 B
Text
6 lines
399 B
Text
$NetBSD: distinfo,v 1.9 2019/08/27 06:01:23 adam Exp $
|
|
|
|
SHA1 (httpie-1.0.3.tar.gz) = 476fde8aa1827f7dd65c3a114e80023450df0bff
|
|
RMD160 (httpie-1.0.3.tar.gz) = ce5d7149dcca76a93c8f4d9a8d19c7560b8463ca
|
|
SHA512 (httpie-1.0.3.tar.gz) = b51779e0ec8f24108ee3f4bf690dc9dfddafff42509d1aa3d13ac12d65a93e02aad9644dc10134ebdbebf949b250cb288650a4dad3d382143e9ad3b9b0ac8c16
|
|
Size (httpie-1.0.3.tar.gz) = 86725 bytes
|