From 67f1aafd610c028b160f2f2ac805e671ed7073de Mon Sep 17 00:00:00 2001 From: eldritch horrors Date: Tue, 22 Oct 2024 18:00:00 +0200 Subject: [PATCH] libstore: restrict curl protocols previously it was possible to fetchurl a dict server, or an ldap server, or an imap server. this is a bit of a problem, both because rare schemes may not be available on all systems, and because some schemes (e.g. scp) are inherently insecure in potentially surprising ways we needn't allow. Change-Id: I18fc567c6f58c3221b5ea8ce927f4da780057828 --- doc/manual/rl-next/download-protocols.md | 10 ++++++++++ src/libstore/filetransfer.cc | 2 ++ 2 files changed, 12 insertions(+) create mode 100644 doc/manual/rl-next/download-protocols.md diff --git a/doc/manual/rl-next/download-protocols.md b/doc/manual/rl-next/download-protocols.md new file mode 100644 index 000000000..bf1bf79a3 --- /dev/null +++ b/doc/manual/rl-next/download-protocols.md @@ -0,0 +1,10 @@ +--- +synopsis: "transfers no longer allow arbitrary url schemas" +category: Breaking Changes +cls: [2106] +credits: horrors +--- + +Lix no longer allows transfers using arbitrary url schemas. Only `http://`, `https://`, `ftp://`, `ftps://`, and `file://` urls are supported going forward. This affects `builtins.fetchurl`, ``, transfers to and from binary caches, and all other uses of the internal file transfer code. Flake inputs using multi-protocol schemas (e.g. `git+ssh`) are not affected as those use external utilities to transfer data. + +The `s3://` scheme is not affected at all by this change and continues to work if S3 support is built into Lix. diff --git a/src/libstore/filetransfer.cc b/src/libstore/filetransfer.cc index 34b92148e..acbb042b7 100644 --- a/src/libstore/filetransfer.cc +++ b/src/libstore/filetransfer.cc @@ -282,6 +282,8 @@ struct curlFileTransfer : public FileTransfer curl_easy_setopt(req, CURLOPT_PROGRESSDATA, this); curl_easy_setopt(req, CURLOPT_NOPROGRESS, 0); + curl_easy_setopt(req, CURLOPT_PROTOCOLS_STR, "http,https,ftp,ftps,file"); + curl_easy_setopt(req, CURLOPT_HTTPHEADER, requestHeaders); if (settings.downloadSpeed.get() > 0)