mirror of
https://github.com/git/git
synced 2024-08-24 18:26:02 +00:00
Merge branch 'gc/redact-h2h3-headers'
Redact headers from cURL's h2h3 module in GIT_CURL_VERBOSE and others. * gc/redact-h2h3-headers: http: redact curl h2h3 headers in info t: run t5551 tests with both HTTP and HTTP/2
This commit is contained in:
commit
6adf17050b
47
http.c
47
http.c
|
@ -560,13 +560,15 @@ static void set_curl_keepalive(CURL *c)
|
|||
}
|
||||
#endif
|
||||
|
||||
static void redact_sensitive_header(struct strbuf *header)
|
||||
/* Return 1 if redactions have been made, 0 otherwise. */
|
||||
static int redact_sensitive_header(struct strbuf *header, size_t offset)
|
||||
{
|
||||
int ret = 0;
|
||||
const char *sensitive_header;
|
||||
|
||||
if (trace_curl_redact &&
|
||||
(skip_iprefix(header->buf, "Authorization:", &sensitive_header) ||
|
||||
skip_iprefix(header->buf, "Proxy-Authorization:", &sensitive_header))) {
|
||||
(skip_iprefix(header->buf + offset, "Authorization:", &sensitive_header) ||
|
||||
skip_iprefix(header->buf + offset, "Proxy-Authorization:", &sensitive_header))) {
|
||||
/* The first token is the type, which is OK to log */
|
||||
while (isspace(*sensitive_header))
|
||||
sensitive_header++;
|
||||
|
@ -575,8 +577,9 @@ static void redact_sensitive_header(struct strbuf *header)
|
|||
/* Everything else is opaque and possibly sensitive */
|
||||
strbuf_setlen(header, sensitive_header - header->buf);
|
||||
strbuf_addstr(header, " <redacted>");
|
||||
ret = 1;
|
||||
} else if (trace_curl_redact &&
|
||||
skip_iprefix(header->buf, "Cookie:", &sensitive_header)) {
|
||||
skip_iprefix(header->buf + offset, "Cookie:", &sensitive_header)) {
|
||||
struct strbuf redacted_header = STRBUF_INIT;
|
||||
const char *cookie;
|
||||
|
||||
|
@ -612,6 +615,26 @@ static void redact_sensitive_header(struct strbuf *header)
|
|||
|
||||
strbuf_setlen(header, sensitive_header - header->buf);
|
||||
strbuf_addbuf(header, &redacted_header);
|
||||
ret = 1;
|
||||
}
|
||||
return ret;
|
||||
}
|
||||
|
||||
/* Redact headers in info */
|
||||
static void redact_sensitive_info_header(struct strbuf *header)
|
||||
{
|
||||
const char *sensitive_header;
|
||||
|
||||
/*
|
||||
* curl's h2h3 prints headers in info, e.g.:
|
||||
* h2h3 [<header-name>: <header-val>]
|
||||
*/
|
||||
if (trace_curl_redact &&
|
||||
skip_iprefix(header->buf, "h2h3 [", &sensitive_header)) {
|
||||
if (redact_sensitive_header(header, sensitive_header - header->buf)) {
|
||||
/* redaction ate our closing bracket */
|
||||
strbuf_addch(header, ']');
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
@ -629,7 +652,7 @@ static void curl_dump_header(const char *text, unsigned char *ptr, size_t size,
|
|||
|
||||
for (header = headers; *header; header++) {
|
||||
if (hide_sensitive_header)
|
||||
redact_sensitive_header(*header);
|
||||
redact_sensitive_header(*header, 0);
|
||||
strbuf_insertstr((*header), 0, text);
|
||||
strbuf_insertstr((*header), strlen(text), ": ");
|
||||
strbuf_rtrim((*header));
|
||||
|
@ -668,6 +691,18 @@ static void curl_dump_data(const char *text, unsigned char *ptr, size_t size)
|
|||
strbuf_release(&out);
|
||||
}
|
||||
|
||||
static void curl_dump_info(char *data, size_t size)
|
||||
{
|
||||
struct strbuf buf = STRBUF_INIT;
|
||||
|
||||
strbuf_add(&buf, data, size);
|
||||
|
||||
redact_sensitive_info_header(&buf);
|
||||
trace_printf_key(&trace_curl, "== Info: %s", buf.buf);
|
||||
|
||||
strbuf_release(&buf);
|
||||
}
|
||||
|
||||
static int curl_trace(CURL *handle, curl_infotype type, char *data, size_t size, void *userp)
|
||||
{
|
||||
const char *text;
|
||||
|
@ -675,7 +710,7 @@ static int curl_trace(CURL *handle, curl_infotype type, char *data, size_t size,
|
|||
|
||||
switch (type) {
|
||||
case CURLINFO_TEXT:
|
||||
trace_printf_key(&trace_curl, "== Info: %s", data);
|
||||
curl_dump_info(data, size);
|
||||
break;
|
||||
case CURLINFO_HEADER_OUT:
|
||||
text = "=> Send header";
|
||||
|
|
|
@ -174,6 +174,11 @@ prepare_httpd() {
|
|||
fi
|
||||
}
|
||||
|
||||
enable_http2 () {
|
||||
HTTPD_PARA="$HTTPD_PARA -DHTTP2"
|
||||
test_set_prereq HTTP2
|
||||
}
|
||||
|
||||
start_httpd() {
|
||||
prepare_httpd >&3 2>&4
|
||||
|
||||
|
|
|
@ -29,6 +29,11 @@ ErrorLog error.log
|
|||
LoadModule setenvif_module modules/mod_setenvif.so
|
||||
</IfModule>
|
||||
|
||||
<IfDefine HTTP2>
|
||||
LoadModule http2_module modules/mod_http2.so
|
||||
Protocols h2c
|
||||
</IfDefine>
|
||||
|
||||
<IfVersion < 2.4>
|
||||
LockFile accept.lock
|
||||
</IfVersion>
|
||||
|
@ -64,12 +69,20 @@ LockFile accept.lock
|
|||
<IfModule !mod_access_compat.c>
|
||||
LoadModule access_compat_module modules/mod_access_compat.so
|
||||
</IfModule>
|
||||
<IfModule !mod_mpm_prefork.c>
|
||||
LoadModule mpm_prefork_module modules/mod_mpm_prefork.so
|
||||
</IfModule>
|
||||
<IfModule !mod_unixd.c>
|
||||
LoadModule unixd_module modules/mod_unixd.so
|
||||
</IfModule>
|
||||
|
||||
<IfDefine HTTP2>
|
||||
<IfModule !mod_mpm_event.c>
|
||||
LoadModule mpm_event_module modules/mod_mpm_event.so
|
||||
</IfModule>
|
||||
</IfDefine>
|
||||
<IfDefine !HTTP2>
|
||||
<IfModule !mod_mpm_prefork.c>
|
||||
LoadModule mpm_prefork_module modules/mod_mpm_prefork.so
|
||||
</IfModule>
|
||||
</IfDefine>
|
||||
</IfVersion>
|
||||
|
||||
PassEnv GIT_VALGRIND
|
||||
|
|
|
@ -1,13 +1,19 @@
|
|||
#!/bin/sh
|
||||
|
||||
test_description='test smart fetching over http via http-backend'
|
||||
: ${HTTP_PROTO:=HTTP}
|
||||
test_description="test smart fetching over http via http-backend ($HTTP_PROTO)"
|
||||
GIT_TEST_DEFAULT_INITIAL_BRANCH_NAME=main
|
||||
export GIT_TEST_DEFAULT_INITIAL_BRANCH_NAME
|
||||
|
||||
. ./test-lib.sh
|
||||
. "$TEST_DIRECTORY"/lib-httpd.sh
|
||||
test "$HTTP_PROTO" = "HTTP/2" && enable_http2
|
||||
start_httpd
|
||||
|
||||
test_expect_success HTTP2 'enable client-side http/2' '
|
||||
git config --global http.version HTTP/2
|
||||
'
|
||||
|
||||
test_expect_success 'setup repository' '
|
||||
git config push.default matching &&
|
||||
echo content >file &&
|
||||
|
@ -347,7 +353,10 @@ test_expect_success CMDLINE_LIMIT \
|
|||
test_expect_success 'large fetch-pack requests can be sent using chunked encoding' '
|
||||
GIT_TRACE_CURL=true git -c http.postbuffer=65536 \
|
||||
clone --bare "$HTTPD_URL/smart/repo.git" split.git 2>err &&
|
||||
grep "^=> Send header: Transfer-Encoding: chunked" err
|
||||
{
|
||||
test_have_prereq HTTP2 ||
|
||||
grep "^=> Send header: Transfer-Encoding: chunked" err
|
||||
}
|
||||
'
|
||||
|
||||
test_expect_success 'test allowreachablesha1inwant' '
|
||||
|
|
4
t/t5559-http-fetch-smart-http2.sh
Executable file
4
t/t5559-http-fetch-smart-http2.sh
Executable file
|
@ -0,0 +1,4 @@
|
|||
#!/bin/sh
|
||||
|
||||
HTTP_PROTO=HTTP/2
|
||||
. ./t5551-http-fetch-smart.sh
|
Loading…
Reference in a new issue