Repository navigation
Conversation
The scheme was only checked on the URL the user wrote. A server answering an https URL with a redirect to http was followed by the client without any further check, so both the HEAD probe and the download travelled in the clear, and a network attacker could substitute the Taskfile that is about to be executed. CheckRedirect now refuses an https to http hop. --insecure does not loosen it: requesting an http entrypoint is the user's decision, being sent to one is the server's. Setting CheckRedirect also replaces Go's default cap, so the ten-hop limit is kept explicitly. The three call sites turned almost every client error into a generic download failure, which would have hidden the reason; TaskfileNotSecureError is now passed through, with wording of its own for the redirect case since --insecure is not a way out of it.
The same policy — keep TaskfileNotSecureError, make everything else a generic download failure — was spelled out at each of the three call sites, where copies of a security rule tend to drift apart.
Refusing it unconditionally was security theatre: --insecure also sets InsecureSkipVerify, so an attacker in position to intercept can already serve anything over the https leg with a self-signed certificate. It also broke an internal server that redirects and works today. --insecure now means one thing everywhere: the transport guarantees are waived.
An https remote redirected to http on the same host kept its Host string, so remote.headers were sent over the plaintext hop. This was reachable under --insecure, which allows the downgrade redirect.
vmaerten
marked this pull request as ready for review
November 5, 2026 20:38
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
An
httpsremote Taskfile redirected tohttpwas downloaded over the plaintext hop without--insecure, andremote.headerswere sent on a same-hosthttpstohttpredirect because they were scoped by host only. Such a redirect now requires--insecure, like anhttpentrypoint, and configured headers are only sent when both the host and the scheme match the origin. Supersedes #3003.Test plan
TestCheckRedirect*: anhttpstohttphop is refused unless--insecureis set, and the 10-redirect cap still applies.TestBuildHTTPClientRefusesDowngrade/TestBuildHTTPClientFollowsDowngradeWithInsecure: end to end against a TLS server redirecting to a plain one; the plaintext server is never contacted without--insecure.TestHeadersTransport: headers are not added to a request on the same host overhttp.--insecure.Checklist