Re: [bitbake-devel] [PATCH 0/2] fetch2/wget: limit auth headers on checkstatus redirects

Unusually, this was rapidly merged to master almost immediately after
the patches were posted. Is this a sensitive security issue, or what
is the rationale?

Alex


On Wed, 10 Jun 2026 at 09:40, Anders Heimer via lists.openembedded.org
<[email protected]> wrote:
>
> FixedHTTPRedirectHandler currently copies request headers when following
> redirects. The first patch drops Authorization and Cookie when the
> redirect target has a different origin.
>
> The second patch adds local HTTP server tests covering both same-origin
> and different-origin redirects.
>
> Anders Heimer (2):
>   fetch2/wget: limit auth on checkstatus redirects
>   tests/fetch: cover checkstatus redirect auth handling
>
>  lib/bb/fetch2/wget.py | 27 +++++++++++++++++--
>  lib/bb/tests/fetch.py | 62 +++++++++++++++++++++++++++++++++++++++++++
>  2 files changed, 87 insertions(+), 2 deletions(-)
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#19636): https://lists.openembedded.org/g/bitbake-devel/message/19636
> Mute This Topic: https://lists.openembedded.org/mt/119736443/1686489
> Group Owner: [email protected]
> Unsubscribe: https://lists.openembedded.org/g/bitbake-devel/unsub [[email protected]]
> -=-=-=-=-=-=-=-=-=-=-=-
>