Re: [PATCH 0/6] restricting http redirects

2016-12-05 Thread Jeff King
On Thu, Dec 01, 2016 at 04:03:37AM -0500, Jeff King wrote: > Jann Horn brought up on the git-security list some interesting > social-engineering attacks around the way Git handles HTTP redirects. > These patches are my attempt to harden our redirect handling against > these attacks. There's one o

[PATCH 0/6] restricting http redirects

2016-12-01 Thread Jeff King
Jann Horn brought up on the git-security list some interesting social-engineering attacks around the way Git handles HTTP redirects. These patches are my attempt to harden our redirect handling against these attacks. Out of the box, they should make it more obvious to the user when we are redirect