naruto-lgtm opened a new pull request, #1456: URL: https://github.com/apache/poi/pull/1456
Repro: with `setFollowRedirects(true)` and `tspUser`/`tspPass` set, an https TSP that answers 302 with an `http://` Location gets the Basic credentials resent in cleartext. `TestTimeStampSimpleHttpClient` shows this against a local self-signed https endpoint and fails before the change. Cause: `handleRedirect` copies every configured header, `Authorization` included, onto the redirect connection. HttpURLConnection already follows same-protocol redirects itself and drops `Authorization` when it does, so the redirects that reach POI's code are exactly the scheme-changing ones (https to http, or http to https on any host the Location names, which a MITM on a plain-http TSP controls). Fix: resend `Authorization` only to the same host on the same scheme and port, or on an http to https upgrade with default ports; other redirects are still followed, just without credentials. A TSP that moves to a different host and needs auth there will now get a 401 instead of silently receiving the password, which seems the safer default; a custom `TimeStampHttpClient` can still choose otherwise. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
