oscerd commented on PR #143: URL: https://github.com/apache/camel-kit/pull/143#issuecomment-6572745268
Thanks for the thorough review — both P2 findings are addressed in `182dcc9` (follow-up commit, so the delta is visible): **1. Redirect enforcement before the request.** You were right: `Redirect.NORMAL` followed a loopback→non-loopback-http hop without re-validation. Switched the client to `Redirect.NEVER` and now follow redirects manually in the shared `send()` path, calling `requireFetchableUri()` on each hop **before** issuing it — bounded to 5 hops, preserving the response deadline and body cleanup, and carrying `Accept`. All three fetch paths (manifest, archive, release-discovery) go through `send()`, so they're covered by construction. HTTPS→HTTPS redirects (GitHub release assets) still work — `loopbackHttpRedirectIsFollowed` follows a loopback→loopback redirect, and `manifestRedirectToNonLoopbackHttpIsRejected` refuses a loopback→remote-http one before the request. **2. Independent guard-site tests.** Added rejection tests exercising each entry point on its own: `releasesEndpointOverNonLoopbackHttpIsRejected` (discovery endpoint), `discoveredManifestUrlOverNonLoopbackHttpIsRejected` (the release-asset `browser_download_url`, via a loopback releases fixture), and `resolvedArchiveUrlOverNonLoopbackHttpIsRejected` (an absolute non-loopback `asset` in the manifest). Each asserts refusal before the remote request and no activation of rejected content. `IndexDownloaderTest` 67 and `IndexDownloaderTimeoutTest` 10 pass; `-Psourcecheck validate` clean. _AI-generated by Claude Code (Claude Opus 4.8) on behalf of @oscerd._ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
