mirror of
https://github.com/go-task/task.git
synced 2026-09-02 04:02:08 +02:00
25fc28927d
The scheme was only checked on the URL the user wrote. A server answering an https URL with a redirect to http was followed by the client without any further check, so both the HEAD probe and the download travelled in the clear, and a network attacker could substitute the Taskfile that is about to be executed. CheckRedirect now refuses an https to http hop. --insecure does not loosen it: requesting an http entrypoint is the user's decision, being sent to one is the server's. Setting CheckRedirect also replaces Go's default cap, so the ten-hop limit is kept explicitly. The three call sites turned almost every client error into a generic download failure, which would have hidden the reason; TaskfileNotSecureError is now passed through, with wording of its own for the redirect case since --insecure is not a way out of it.
Task: The Modern Task Runner
A fast, cross-platform build tool inspired by Make, designed for modern workflows.
Installation • Getting Started • Docs • Twitter • Bluesky • Mastodon • Discord
Gold Sponsors
|
|
|
Community Sponsors
|
|
| Package hosting provided by Cloudsmith. | Tooling provided by JetBrains. |