Fixed CVE-2019-10751 — the way the output filename is generated for --download requests without --output resulting in a redirect has been changed to only consider the initial URL as the base for the generated filename, and not the final one. This fixes a potential security issue under the following scenario:
A --download request with no explicit --output is made (e.g., $ http -d example.org/file.txt), instructing HTTPie to generate the output filename from the Content-Disposition response header, or from the URL if the header is not provided.
The server handling the request has been modified by an attacker and instead of the expected response the URL returns a redirect to another URL, e.g., attacker.example.org/.bash_profile, whose response does not provide a Content-Disposition header (i.e., the base for the generated filename becomes .bash_profile instead of file.txt).
Your current directory doesn’t already contain .bash_profile (i.e., no unique suffix is added to the generated filename).
You don’t notice the potentially unexpected output filename as reported by HTTPie in the console output (e.g., Downloading 100.00 B to ".bash_profile").
HTTPie 1.0.2
Fixed tests for installation with pyOpenSSL.
HTTPie 1.0.1
Removed external URL calls from tests.
HTTPie 1.0.0
Added --style=auto which follows the terminal ANSI color styles.
Added support for selecting TLS 1.3 via --ssl=tls1.3
(available once implemented in upstream libraries).
Added true/false as valid values for --verify
(in addition to yes/no) and the boolean value is case-insensitive.
Changed the default --style from solarized to auto (on Windows it stays fruity).
Fixed default headers being incorrectly case-sensitive.
Fixed CVE-2019-10751 — the way the output filename is generated for
--download requests without --output resulting in a redirect has
been changed to only consider the initial URL as the base for the generated
filename, and not the final one. This fixes a potential security issue under
the following scenario:
A --download request with no explicit --output is made (e.g.,
$ http -d example.org/file.txt), instructing httpie to
generate the output filename <https://httpie.org/doc#downloaded-filename>_
from the Content-Disposition response header, or from the URL if the header
is not provided.
The server handling the request has been modified by an attacker and
instead of the expected response the URL returns a redirect to another
URL, e.g., attacker.example.org/.bash_profile, whose response does
not provide a Content-Disposition header (i.e., the base for the
generated filename becomes .bash_profile instead of file.txt).
Your current directory doesn’t already contain .bash_profile
(i.e., no unique suffix is added to the generated filename).
You don’t notice the potentially unexpected output filename
as reported by httpie in the console output
(e.g., Downloading 100.00 B to ".bash_profile").
Reported by Raul Onitza and Giulio Comi.
1.0.2_ (2018-11-14)
Fixed tests for installation with pyOpenSSL.
1.0.1_ (2018-11-14)
Removed external URL calls from tests.
1.0.0_ (2018-11-02)
Added --style=auto which follows the terminal ANSI color styles.
Added support for selecting TLS 1.3 via --ssl=tls1.3
(available once implemented in upstream libraries).
Added true/false as valid values for --verify
(in addition to yes/no) and the boolean value is case-insensitive.
Changed the default --style from solarized to auto (on Windows it stays fruity).
Fixed default headers being incorrectly case-sensitive.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
- `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language
- `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language
- `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language
- `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/hashicorp/consul-guides/network/alerts).
dependabot[bot]
commented
2 years ago
Bumps httpie from 0.9.9 to 1.0.3.
Release notes
Sourced from httpie's releases.
Changelog
Sourced from httpie's changelog.
... (truncated)
Commits
747be301.0.388a9583Update CHANGELOG.rstfd6e879README6dee493Fix commentsdf36d62Changed the way the output filename is generatede92b831Create FUNDING.ymlfd44f1aUpdated Readme to fix a typo (#767)b630954Add a bash here string example3a46149Fix several ResourceWarning: unclosed file (#741)b7c8bf0Add animation by @loranallensmithDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/hashicorp/consul-guides/network/alerts).