Skip to content

git: Globally disable HTTP redirects

Patrick Steinhardt requested to merge pks-git-disable-http-redirects into master

While we've been careful to disable HTTP redirects in RPCs which interact with remote repositories where the URL is user-supplied, it feels a bit like whack-a-mole to always have to remember to supply the required config option when adding any new calls. It's fragile, and given that it can have security implications to allow redirects, this is not an area of code we want to be fragile.

Improve this by instead globally disabling HTTP redirects for all Git commands we're using which interact with a remote repository. Namely, this includes git-clone, git-fetch, git-ls-remote, git-push and git-remote.

Merge request reports