Nick Craig-Wood aef94cd0e7 http: don't leak configured headers to other hosts or over plaintext on redirect GHSA-486v-q2wf-fp2r CVE-PENDING ...

The headers set with --http-headers are documented for passing
credentials such as Authorization or Cookie. The backend used the
default net/http redirect policy which copies all but a handful of
well known headers to any redirect target, so a redirect from the
configured server to another host would send those credentials to
that host, and a redirect from https to http would send them in
plaintext.

When headers are configured this installs a CheckRedirect function
which:

- removes the configured headers from every hop once the redirect
  chain has left the originally requested host
- refuses a redirect from https to http with an error

2026-09-04 19:00:22 +01:00

..

alias

config: make getting config values more consistent

2024-08-08 13:41:31 +01:00

all

Add Huawei Drive support

2026-05-01 13:41:07 +01:00

archive

archive: hide any archive entry which escapes the directory being listed GHSA-66hp-wgxq-6f5q

2026-09-04 19:00:22 +01:00

azureblob

azureblob: fix test which didn't compile

2026-08-25 09:31:40 +01:00

azurefiles

build: modernize with "go fix -newexpr": use go1.26 new(expr)

2026-08-21 12:23:31 +01:00

b2

b2: add server side copy real time accounting

2026-03-03 14:01:11 +00:00

box

box: reuse multipart upload part buffers via the global pool

2026-09-01 14:21:52 +01:00

cache

cache: fix test flakiness by stopping the chunk cleaner promptly

2026-07-12 13:26:17 +01:00

chunker

build: modernize with "go fix -stringscut": use strings.Cut

2026-08-21 12:23:31 +01:00

cloudinary

build: modernize with "go fix -newexpr": use go1.26 new(expr)

2026-08-21 12:23:31 +01:00

combine

combine: don't return an error message as the remote name for a bad object

2026-07-16 14:47:03 +01:00

compress

compress: stop buffering the compressibility check output in memory

2026-09-01 14:21:52 +01:00

crypt

crypt: warn about directories with legacy version-like encrypted names

2026-08-27 17:28:04 +01:00

doi

docs: fix typos in comments and messages

2026-01-18 20:48:33 +01:00

drime

Revert "drime: disable server side copy as it always fails"

2026-07-27 12:27:02 +01:00

drive

drive: reuse resumable-upload chunk buffers via multipart.NewRW

2026-08-30 13:07:41 +01:00

dropbox

dropbox: reuse upload chunk buffers via the global memory pool

2026-09-01 14:21:52 +01:00

fichier

fichier: fix server side move - fixes #7856

2024-09-06 18:20:10 +01:00

filefabric

build: modernize Go usage

2025-02-28 11:31:14 +00:00

filelu

filelu: reuse multipart upload buffers via the global pool and retry failed parts

2026-09-01 14:21:52 +01:00

filen

filen: fix incorrect modtime after updating a file or setting its modtime

2026-07-13 11:22:04 +01:00

filescom

build: modernize with "go fix -newexpr": use go1.26 new(expr)

2026-08-21 12:23:31 +01:00

ftp

build: modernize with "go fix -stringscut": use strings.Cut

2026-08-21 12:23:31 +01:00

gofile

build: modernize with "go fix -errorsastype": use errors.AsType

2026-08-21 12:23:31 +01:00

googlecloudstorage

googlecloudstorage: improve endpoint parameter docs

2025-12-01 19:04:02 +00:00

googlephotos

drive, googlephotos: warn in config wizard before using the shared client_id #9580

2026-07-07 12:35:37 +01:00

hasher

hasher: fix Update not storing hashes in bolt DB after file replacement

2026-07-13 10:44:03 +01:00

hdfs

hdfs: fix incorrect modtime after uploading a file or setting its modtime

2026-07-13 13:53:29 +01:00

hidrive

hidrive: buffer small file updates from the global memory pool

2026-09-01 14:21:52 +01:00

http

http: don't leak configured headers to other hosts or over plaintext on redirect GHSA-486v-q2wf-fp2r CVE-PENDING

2026-09-04 19:00:22 +01:00

huaweidrive

huaweidrive: reuse resumable-upload chunk buffers via the global pool

2026-09-01 14:21:52 +01:00

iclouddrive

build: modernize with "go fix -stringscutprefix": use strings.CutPrefix

2026-08-21 12:23:31 +01:00

imagekit

imagekit: add mtime to the available metadata

2026-07-17 18:29:39 +01:00

internetarchive

internetarchive: fix corrupted files being created when the source ends early

2026-08-11 19:32:12 +01:00

internxt

internxt: persist rotated token returned by the user info call

2026-08-27 14:14:40 +01:00

jottacloud

jottacloud: buffer MD5 pre-reads in the global memory pool

2026-09-01 14:21:52 +01:00

koofr

docs: fix some function names in comments

2025-06-24 15:04:45 +01:00

linkbox

linkbox: buffer the hashed 10 MiB file prefix in the global memory pool

2026-09-01 14:21:52 +01:00

local

local: fix panic on Range request past the end of a symlink GHSA-p6m2-r3w9-mpxw CVE-PENDING

2026-09-04 19:00:22 +01:00

mailru

mailru: buffer speedup hashing in the global memory pool and fix upload retries

2026-09-01 14:21:52 +01:00

mega

mega: fix moved files disappearing from listings between remotes

2026-07-20 17:37:16 +01:00

memory

memory: add --memory-discard flag for speed testing - fixes #9037

2025-12-17 10:21:12 +00:00

netstorage

netstorage: fix missing MD5 hash after uploading a file

2026-07-14 14:13:49 +01:00

onedrive

onedrive: reuse upload chunk buffers via the global memory pool

2026-09-01 14:21:52 +01:00

opendrive

opendrive: reuse upload chunk buffers via the global memory pool

2026-09-01 14:21:52 +01:00

oracleobjectstorage

build: modernize with "go fix -newexpr": use go1.26 new(expr)

2026-08-21 12:23:31 +01:00

overview

overview: fix "internal error: no overview data found" on 32 bit architectures - fixes #9723

2026-08-04 19:29:21 +01:00

pcloud

pcloud: fix recursive listing from the root - fixes #9315

2026-04-20 12:16:10 +01:00

pikpak

pikpak: use pooled memory for the gcid hash buffer and spool unknown-size uploads to disk

2026-09-01 14:21:52 +01:00

pixeldrain

pixeldrain: fix incorrect modtime and missing hash after uploading a file

2026-07-14 14:13:49 +01:00

premiumizeme

about: fix potential overflow of about in various backends

2025-07-31 11:38:51 +01:00

protondrive

protondrive: fix Go 1.27 vet warning in retry test

2026-08-29 13:13:34 +01:00

putio

putio: reuse upload chunk buffers via the global memory pool

2026-09-01 14:21:52 +01:00

qingstor

walk: move NewListRHelper into list.Helper to avoid circular dependency

2025-04-08 15:14:00 +01:00

quatrix

quatrix: fix chunk upload retries and fix memory leak

2026-09-01 14:21:52 +01:00

s3

s3: avoid buffering Object Lock uploads when the source MD5 is known

2026-09-01 14:21:52 +01:00

seafile

seafile: don't implement IDer as the id is a content hash not a unique ID

2026-07-09 17:50:26 +01:00

sftp

sftp: implement multi-thread uploads - fixes #8185

2026-08-30 13:06:06 +01:00

shade

shade: stop copying each upload chunk into a second heap buffer

2026-09-01 14:21:52 +01:00

sharefile

build: modernize Go code with go fix for go1.25

2026-02-18 12:11:52 +00:00

sia

sia: fix corrupted files being created when the source ends early

2026-08-11 19:32:12 +01:00

smb

filepool: add generic file handle pool in lib/filepool

2026-08-30 13:06:06 +01:00

storj

build: fix linting issues reported by running golangci-lint with different GOOS

2024-04-22 19:29:12 +02:00

sugarsync

oauthutil: clarify token replacement prompt wording

2026-05-06 10:51:16 +01:00

swift

chore: fix some function names in comments

2026-07-02 11:30:15 +01:00

ulozto

ulozto: fix server side moves between differently rooted remotes losing files

2026-07-17 18:29:39 +01:00

union

build: remove x := x made unnecessary by the new semantics of loops in go1.22

2025-09-14 15:58:20 +01:00

webdav

webdav: fix SetModTime failing and hashes missing on Nextcloud

2026-08-26 12:00:22 +01:00

yandex

yandex: fix truncated files being uploaded successfully when the source ends early

2026-08-21 17:46:05 +01:00

zoho

build: modernize with "go fix -rangeint": use range over int

2026-08-21 12:23:31 +01:00