From 70f42e7df0ae2f8bd5ef8e638520f2fa8b4f1c2a Mon Sep 17 00:00:00 2001 From: Jan Smid Date: Thu, 6 Aug 2026 13:37:33 +0200 Subject: [PATCH] Fix case-insensitive HTTP scheme bypass in isSecure() Lowercase the URL before checking for insecure HTTP schemes, preventing mixed-case variants like Http:// or HTTP:// from bypassing the transport security check. Ref: https://issues.redhat.com/browse/EC-2014 --- internal/downloader/downloader.go | 3 ++- internal/downloader/downloader_test.go | 4 ++++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/internal/downloader/downloader.go b/internal/downloader/downloader.go index 6c0aac193..d19e395d8 100644 --- a/internal/downloader/downloader.go +++ b/internal/downloader/downloader.go @@ -151,5 +151,6 @@ var insecure = regexp.MustCompile("^[A-Za-z0-9]*::http:") // - http -- not deemed secure // - https -- deemed secure func isSecure(url string) bool { - return !strings.HasPrefix(url, "http:") && !insecure.MatchString(url) + lower := strings.ToLower(url) + return !strings.HasPrefix(lower, "http:") && !insecure.MatchString(lower) } diff --git a/internal/downloader/downloader_test.go b/internal/downloader/downloader_test.go index 48b0db9e0..84fc5976e 100644 --- a/internal/downloader/downloader_test.go +++ b/internal/downloader/downloader_test.go @@ -142,7 +142,11 @@ func TestIsSecure(t *testing.T) { insecure := []string{ "http://example.com", + "Http://example.com", + "HTTP://example.com", + "hTTp://example.com", "git::http://github.com/org/repository", + "git::Http://github.com/org/repository", "hg::http://github.com/org/repository", "http::http://github.com/org/repository", "s3::http://127.0.0.1:9000/test-bucket/hello.txt?aws_access_key_id=KEYID&aws_access_key_secret=SECRETKEY®ion=us-east-2",