Nick Craig-Wood 1a28451ea6 s3: strip STS security token on same-host HTTPS->HTTP redirect GHSA-cf44-9pgv-m4xc ...

The CheckRedirect policy strips the X-Amz-Security-Token header when a
redirect chain crosses a host, but it only compared the host and ignored
the scheme. A redirect that kept the same host:port but downgraded
https:// to http:// was treated as the same host, so the STS session
token was re-sent over a plaintext connection where it could be observed.

Fixes GHSA-cf44-9pgv-m4xc

2026-07-08 16:08:32 +01:00

..

alias

config: make getting config values more consistent

2024-08-08 13:41:31 +01:00

all

Add Huawei Drive support

2026-05-01 13:41:07 +01:00

archive

vfs: add context parameter to New() for config propagation

2026-04-13 12:48:38 +01:00

azureblob

azureblob: add --azureblob-decompress flag to download gzip-encoded files

2026-04-13 18:05:52 +01:00

azurefiles

azurefiles: fix missing x-ms-file-request-intent header with OAuth - fixes #9367

2026-04-24 15:55:53 +01:00

b2

b2: add server side copy real time accounting

2026-03-03 14:01:11 +00:00

box

box: allow to configure with config file contents

2025-11-18 16:09:06 +00:00

cache

rc: flip auth default so all endpoints require auth unless opted out

2026-04-19 13:31:27 +01:00

chunker

chunker: fix double-transform

2025-06-12 18:31:01 +01:00

cloudinary

cloudinary: fix retrying every error and fix pacer sleep units

2026-05-06 17:47:53 +01:00

combine

build: remove x := x made unnecessary by the new semantics of loops in go1.22

2025-09-14 15:58:20 +01:00

compress

backend/compress: add zstd compression

2025-11-04 14:50:56 +00:00

crypt

refactor: use strings.Cut to simplify code

2025-11-27 14:42:11 +00:00

doi

docs: fix typos in comments and messages

2026-01-18 20:48:33 +01:00

drime

drime: fix directory rename leaving the renamed folder empty in VFS

2026-05-29 12:51:26 +01:00

drive

drive, googlephotos: warn in config wizard before using the shared client_id #9580

2026-07-07 12:35:37 +01:00

dropbox

dropbox: add--dropbox-skip-shared-folders and --dropbox-skip-unowned-folders

2026-06-25 11:54:14 +01:00

fichier

fichier: fix server side move - fixes #7856

2024-09-06 18:20:10 +01:00

filefabric

build: modernize Go usage

2025-02-28 11:31:14 +00:00

filelu

backend/filelu: fix recursive listing path handling and file filtering

2026-06-08 11:54:43 +01:00

filen

filen: make multi-threaded upload chunks individually retryable

2026-04-10 20:46:55 +01:00

filescom

build: modernize Go usage

2025-02-28 11:31:14 +00:00

ftp

ftp: fix flaky UploadTimeout test on slow integration servers

2026-05-06 11:40:07 +01:00

gofile

backend/gofile: update to use new direct upload endpoint

2025-05-27 14:28:25 +01:00

googlecloudstorage

googlecloudstorage: improve endpoint parameter docs

2025-12-01 19:04:02 +00:00

googlephotos

drive, googlephotos: warn in config wizard before using the shared client_id #9580

2026-07-07 12:35:37 +01:00

hasher

docs: fix markdownlint issues and other styling improvements in backend command docs

2025-11-04 23:00:46 +01:00

hdfs

about: fix potential overflow of about in various backends

2025-07-31 11:38:51 +01:00

hidrive

build: modernize Go usage

2025-02-28 11:31:14 +00:00

http

http: don't list parent directory when pointing at a single file

2026-05-11 11:05:22 +01:00

huaweidrive

refactor: use slices.Contains to simplify code

2026-05-24 19:57:31 +01:00

iclouddrive

iclouddrive: fix "Index has invalid data" error listing iCloud Photos

2026-06-01 17:11:23 +01:00

imagekit

lib/rest: add opts.MultipartContentType to explicitly set Content-Type of attachements

2026-01-08 12:05:37 +00:00

internetarchive

internetarchive: fix server side copy files with spaces

2025-09-04 10:37:27 +01:00

internxt

internxt: implement multi-part uploads

2026-04-24 17:20:18 +01:00

jottacloud

chore: fix some function names in comments

2026-07-02 11:30:15 +01:00

koofr

docs: fix some function names in comments

2025-06-24 15:04:45 +01:00

linkbox

linkbox: fix downloading files by using web API - fixes #8665

2026-04-08 08:49:42 +01:00

local

local: fix getXattr returning empty map instead of nil

2026-05-30 10:57:55 +01:00

mailru

build: modernize Go code with go fix for go1.25

2026-02-18 12:11:52 +00:00

mega

mega: fix hard deleted files reappearing in listings - fixes #9554

2026-07-01 10:06:53 +01:00

memory

memory: add --memory-discard flag for speed testing - fixes #9037

2025-12-17 10:21:12 +00:00

netstorage

docs: fix markdownlint issues and other styling improvements in backend command docs

2025-11-04 23:00:46 +01:00

onedrive

onedrive: add support for no admin mode

2026-05-19 11:21:17 +01:00

opendrive

build: modernize Go usage

2025-02-28 11:31:14 +00:00

oracleobjectstorage

oracleobjectstorage, sftp: eliminate unnecessary heap allocation

2026-01-09 16:10:02 +00:00

pcloud

pcloud: fix recursive listing from the root - fixes #9315

2026-04-20 12:16:10 +01:00

pikpak

build: modernize Go code with go fix for go1.25

2026-02-18 12:11:52 +00:00

pixeldrain

Add pixeldrain backend

2024-08-12 13:35:44 +01:00

premiumizeme

about: fix potential overflow of about in various backends

2025-07-31 11:38:51 +01:00

protondrive

protondrive: implement shouldRetry instead of always returning false

2026-05-24 17:50:01 +01:00

putio

build: modernize Go usage

2025-02-28 11:31:14 +00:00

qingstor

walk: move NewListRHelper into list.Helper to avoid circular dependency

2025-04-08 15:14:00 +01:00

quatrix

build: use the built-in min or max functions added in go1.21

2025-09-15 12:45:57 +01:00

s3

s3: strip STS security token on same-host HTTPS->HTTP redirect GHSA-cf44-9pgv-m4xc

2026-07-08 16:08:32 +01:00

seafile

lib/rest: add opts.MultipartContentType to explicitly set Content-Type of attachements

2026-01-08 12:05:37 +00:00

sftp

sftp: add --sftp-encoding support

2026-05-30 11:01:20 +01:00

shade

build: modernize Go code with go fix for go1.25

2026-02-18 12:11:52 +00:00

sharefile

build: modernize Go code with go fix for go1.25

2026-02-18 12:11:52 +00:00

sia

build: modernize Go usage

2025-02-28 11:31:14 +00:00

smb

smb: optimize smb mount performance by avoiding stat checks during initialization

2025-09-22 15:33:44 +01:00

storj

build: fix linting issues reported by running golangci-lint with different GOOS

2024-04-22 19:29:12 +02:00

sugarsync

oauthutil: clarify token replacement prompt wording

2026-05-06 10:51:16 +01:00

swift

chore: fix some function names in comments

2026-07-02 11:30:15 +01:00

ulozto

ulozto: Fix downloads returning HTML error page

2025-11-10 15:56:06 +00:00

union

build: remove x := x made unnecessary by the new semantics of loops in go1.22

2025-09-14 15:58:20 +01:00

webdav

webdav: fix mixed property statuses in multi-status responses

2026-06-03 18:04:15 +01:00

yandex

chore: fix some function names in comments

2026-07-02 11:30:15 +01:00

zoho

zoho: rate limit repeated listings of the same folder

2026-07-05 12:28:52 +01:00