From 313da6b5696088b6b493695000ef790f277ed505 Mon Sep 17 00:00:00 2001 From: René 'Necoro' Neumann Date: Sun, 9 Jan 2022 23:53:26 +0100 Subject: Ensure that cookies are sent only to the correct domains. We want to avoid that authentication data is sent when fetching images from external sources, for instance. --- internal/http/client.go | 42 ++++++++++++++++++++++++++++++++++++------ 1 file changed, 36 insertions(+), 6 deletions(-) (limited to 'internal/http/client.go') diff --git a/internal/http/client.go b/internal/http/client.go index 4272a5b..b47203d 100644 --- a/internal/http/client.go +++ b/internal/http/client.go @@ -5,6 +5,8 @@ import ( "crypto/tls" "fmt" "net/http" + "net/http/cookiejar" + urlpkg "net/url" "time" ) @@ -23,7 +25,7 @@ type Error struct { type Context struct { Timeout int DisableTLS bool - Cookies []Cookie + Jar CookieJar } func (err Error) Error() string { @@ -55,8 +57,35 @@ func client(disableTLS bool) *http.Client { var noop ctxt.CancelFunc = func() {} type Cookie struct { - Name string - Value string + Name string + Value string + Domain string +} + +type CookieJar http.CookieJar + +func JarOfCookies(cookies []Cookie, url string) (CookieJar, error) { + jar, err := cookiejar.New(nil) + if err != nil { + return nil, err + } + + cs := make([]*http.Cookie, len(cookies)) + for i, c := range cookies { + cs[i] = &http.Cookie{Name: c.Name, Value: c.Value, Domain: c.Domain} + } + + u, err := urlpkg.Parse(url) + if err != nil { + return nil, err + } + + // ignore the path of the URL + u.Path = "" + + jar.SetCookies(u, cs) + + return jar, nil } func Get(url string, ctx Context) (resp *http.Response, cancel ctxt.CancelFunc, err error) { @@ -82,9 +111,10 @@ func Get(url string, ctx Context) (resp *http.Response, cancel ctxt.CancelFunc, } req.Header.Set("User-Agent", "Feed2Imap-Go/1.0") - for _, c := range ctx.Cookies { - cookie := http.Cookie{Name: c.Name, Value: c.Value} - req.AddCookie(&cookie) + if ctx.Jar != nil { + for _, c := range ctx.Jar.Cookies(req.URL) { + req.AddCookie(c) + } } resp, err = client(ctx.DisableTLS).Do(req) -- cgit v1.2.3-70-g09d2 >author
path: root/portato/db/database.py (unfollow)
Commit message (Expand)AuthorFilesLines
2010-05-11Improve setup.py for release scriptRené 'Necoro' Neumann1-3/+8
2010-05-11Improve constants.py for release scriptRené 'Necoro' Neumann1-6/+11
2010-05-05Updated polish translationTomasz Osiński1-337/+451
2010-04-28Updated Spanish translationDaniel Halens1-346/+470
2010-04-26Updated italian translation. Thx to PonsiRené 'Necoro' Neumann1-82/+66
2010-04-23new version plugin showed the versions in the wrong orderRené 'Necoro' Neumann1-1/+1
2010-04-23Clearer debug message for packages not in mergequeueRené 'Necoro' Neumann1-1/+1
2010-04-23Reset HOME to /root for rootRené 'Necoro' Neumann1-0/+4
2010-04-23Small error in sqldbRené 'Necoro' Neumann1-1/+1
2010-04-22Updated french translation to current translation status.Clement Bourgeois1-77/+84
2010-04-19Typo in TRANSLATORSRené 'Necoro' Neumann1-1/+1
2010-04-19Updated portguese translationAlberto Federman Neto1-348/+469
2010-04-19Remove unused pythonic eix parser implementationRené 'Necoro' Neumann1-416/+0
2010-04-19Connect the accels from the menu.René 'Necoro' Neumann1-12/+16
2010-04-19Replace 'Portage Warning' by 'External Warning'René 'Necoro' Neumann1-1/+1
2010-04-17Updated italian translation. Thx to PonsiRené 'Necoro' Neumann1-314/+369
2010-04-16Fix gtk deprecation warningRené 'Necoro' Neumann1-1/+1
2010-04-16TypoRené 'Necoro' Neumann2-3/+3
2010-04-16Do not allow portage's sqlite backend for the moment ... bug #564292René 'Necoro' Neumann2-16/+25
2010-04-15Better sorting of the database types in the preferences.René 'Necoro' Neumann2-6/+6
2010-04-15Add notify-python dependency for the version checkerRené 'Necoro' Neumann1-1/+1
2010-04-15Make the database type choice an info messageRené 'Necoro' Neumann2-7/+13
2010-04-15Renamed es_ES to esRené 'Necoro' Neumann1-0/+0
2010-04-15Fixed dependancy of the new_version plugin from "dev-util/git" to "dev-vcs/gi...Clement Bourgeois1-1/+1
2010-04-14Make some useless info messages being debug statementsRené 'Necoro' Neumann2-34/+17
2010-04-14Improve the C modulesRené 'Necoro' Neumann3-37/+52
2010-04-14Small modifications made to the French translation (typos, grammar).Clement Bourgeois1-69/+69
2010-04-14Fixed the unicode support and stuff ... and also made eix faster :)René 'Necoro' Neumann1-20/+22
2010-04-14Disable debug messages by defaultRené 'Necoro' Neumann1-1/+1
2010-04-13Better eix error inheritance and handlingRené 'Necoro' Neumann1-2/+9
2010-04-13Fix the handling of FilterSets. Fixes bug #558887.René 'Necoro' Neumann2-56/+64
2010-04-12Updated newsRené 'Necoro' Neumann1-0/+1
2010-04-13Added my name to translators list.Clement Bourgeois1-0/+1