Jeff King
76524c2604
When we detect that curl performed a redirect of a URL we requested, we
update our base URL to match the new location and flush the http_auth
credentials. This goes back to c93c92f309 (http: update base URLs when
we see redirects, 2013-09-28).
We detect the redirect by comparing the requested URL to the response
from CURLINFO_EFFECTIVE_URL, using a simple string comparison. This has
worked fine for years, but a change in the upcoming curl 8.23.0 adds a
complication. If our URL directly contains credentials (like
"https://user:pass@example.com/foo.git"), then as of 7a6bd027d0
(getinfo: make sure CURLINFO_EFFECTIVE_URL does not contain creds,
2026-09-21), curl will strip the credentials from what it returns (so
just "https://example.com/foo.git" in this case).
This breaks our direct string comparison, and we believe that we've been
redirected. We flush our http_auth credentials, and now subsequent
requests will use the reduced URL, causing us to re-request credentials
from the user. Notably this causes t5550.15 (among others) to complain;
it tries a clone with credentials in the URL, and fails if the user is
prompted at all.
We can handle this new behavior by doing a more careful comparison: if
the direct string comparison fails, we'll strip out the credentials
ourselves and compare. This is a little extra work, but in practice it
should only happen once per process.
I've used curl's curl_url() interface to do the stripping here, mostly
because its behavior should match the stripping it does internally. And
also, though we have code to parse a URL, we don't have any to
reconstruct it, making a single string comparison hard.
One alternative would be to parse with url_parse() or similar, and
compare the individual fields (skipping username/password). I think that
would probably also work in practice, but it seemed to me that the
simplest change would be sticking with string comparisons.
The curl_url() interface appeared in 7.62.0. We document that 7.61.0 is
still supported, so I've made it conditional here. Only new versions
strip the result from CURLINFO_EFFECTIVE_URL, so it's OK for very old
versions to skip the extra comparison. Likewise if we encounter any
errors, we just quietly skip the comparison. That's fine if you don't
have creds in your URLs, and if you do, you'll get end up in the
existing error path (a redirect warning, and eventually an auth
failure).
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
86 lines
2.4 KiB
C
86 lines
2.4 KiB
C
#ifndef GIT_CURL_COMPAT_H
|
|
#define GIT_CURL_COMPAT_H
|
|
#include <curl/curl.h>
|
|
|
|
/**
|
|
* This header centralizes the declaration of our libcurl dependencies
|
|
* to make it easy to discover the oldest versions we support, and to
|
|
* inform decisions about removing support for older libcurl in the
|
|
* future.
|
|
*
|
|
* The oldest supported version of curl is documented in the "INSTALL"
|
|
* document.
|
|
*
|
|
* The source of truth for what versions have which symbols is
|
|
* https://github.com/curl/curl/blob/master/docs/libcurl/symbols-in-versions;
|
|
* the release dates are taken from curl.git (at
|
|
* https://github.com/curl/curl/).
|
|
*
|
|
* For each X symbol we need from curl we define our own
|
|
* GIT_CURL_HAVE_X. If multiple similar symbols with the same prefix
|
|
* were defined in the same version we pick one and check for that name.
|
|
*
|
|
* We may also define a missing CURL_* symbol to its known value, if
|
|
* doing so is sufficient to add support for it to older versions that
|
|
* don't have it.
|
|
*
|
|
* Keep any symbols in date order of when their support was
|
|
* introduced, oldest first, in the official version of cURL library.
|
|
*/
|
|
|
|
/**
|
|
* curl_url() interface added in 7.62.0 (October 2018)
|
|
*/
|
|
#if LIBCURL_VERSION_NUM >= 0x073e00
|
|
#define GIT_CURL_HAVE_CURL_URL
|
|
#endif
|
|
|
|
/**
|
|
* Versions before curl 7.66.0 (September 2019) required manually setting the
|
|
* transfer-encoding for a streaming POST; after that this is handled
|
|
* automatically.
|
|
*/
|
|
#if LIBCURL_VERSION_NUM < 0x074200
|
|
#define GIT_CURL_NEED_TRANSFER_ENCODING_HEADER
|
|
#endif
|
|
|
|
/**
|
|
* CURLINFO_RETRY_AFTER was added in 7.66.0, released in September 2019.
|
|
* It allows curl to automatically parse Retry-After headers.
|
|
*/
|
|
#if LIBCURL_VERSION_NUM >= 0x074200
|
|
#define GIT_CURL_HAVE_CURLINFO_RETRY_AFTER 1
|
|
#endif
|
|
|
|
/**
|
|
* CURLOPT_PROTOCOLS_STR and CURLOPT_REDIR_PROTOCOLS_STR were added in 7.85.0,
|
|
* released in August 2022.
|
|
*/
|
|
#if LIBCURL_VERSION_NUM >= 0x075500
|
|
#define GIT_CURL_HAVE_CURLOPT_PROTOCOLS_STR 1
|
|
#endif
|
|
|
|
/**
|
|
* curl_global_trace() was added in 8.3.0, released September 2023.
|
|
*/
|
|
#if LIBCURL_VERSION_NUM >= 0x080300
|
|
#define GIT_CURL_HAVE_GLOBAL_TRACE 1
|
|
#endif
|
|
|
|
/**
|
|
* CURLOPT_TCP_KEEPCNT was added in 8.9.0, released in July, 2024.
|
|
*/
|
|
#if LIBCURL_VERSION_NUM >= 0x080900
|
|
#define GIT_CURL_HAVE_CURLOPT_TCP_KEEPCNT
|
|
#endif
|
|
|
|
/**
|
|
* CURLOPT_UPLOAD_FLAGS and CURLULFLAG_* were added in 8.13.0,
|
|
* released in April 2025.
|
|
*/
|
|
#if LIBCURL_VERSION_NUM >= 0x080D00
|
|
#define GIT_CURL_HAVE_CURLOPT_UPLOAD_FLAGS
|
|
#endif
|
|
|
|
#endif
|