Elgato_dark/python-tuf
1
0
Fork 0
mirror of https://github.com/theupdateframework/python-tuf synced 2026-05-24 10:08:28 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

ngclient: Do not use urljoin to form metadata URL

Browse source 
urljoin considers the second URL to override the base URL if the second
one contains e.g. hostname: this could lead to ngclient downloading
from the wrong host entirely. Doing that would not compromise the
security of the system as the metadata would still need to be verified,
but would definitely be unexpected and a bug.

Note that we're still not encoding the rolename, it's just inserted into
the URL as is.

Signed-off-by: Jussi Kukkonen <jkukkonen@vmware.com>
This commit is contained in:
Jussi Kukkonen 2021-09-22 12:52:36 +03:00
parent 4d8cbc7010
commit a0cb100cd8
1 changed files with 2 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
tuf/ngclient/updater.py
View file

@ -278,10 +278,9 @@ def _download_metadata(
) -> bytes:
"""Download a metadata file and return it as bytes"""
if version is None:
filename = f"{rolename}.json"
url = f"{self._metadata_base_url}{rolename}.json"
else:
filename = f"{version}.{rolename}.json"
url = parse.urljoin(self._metadata_base_url, filename)
url = f"{self._metadata_base_url}{version}.{rolename}.json"
return self._fetcher.download_bytes(url, length)
def _load_local_metadata(self, rolename: str) -> bytes: