cfait 1.0.2

Powerful, fast and elegant task / TODO manager. (GUI & TUI, CalDAV & local)
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130

// SPDX-License-Identifier: GPL-3.0-or-later
// File: ./src/client/redirect.rs
use http::{Request, Response, Uri};
use std::future::Future;
use std::pin::Pin;
use std::task::{Context, Poll};
use tower_layer::Layer;
use tower_service::Service;

#[derive(Clone, Debug)]
pub struct FollowRedirectLayer {
    max_redirects: usize,
}

impl FollowRedirectLayer {
    pub fn new(max_redirects: usize) -> Self {
        Self { max_redirects }
    }
}

impl<S> Layer<S> for FollowRedirectLayer {
    type Service = FollowRedirectService<S>;

    fn layer(&self, inner: S) -> Self::Service {
        FollowRedirectService {
            inner,
            max_redirects: self.max_redirects,
        }
    }
}

#[derive(Clone, Debug)]
pub struct FollowRedirectService<S> {
    inner: S,
    max_redirects: usize,
}

impl<S, ReqBody, ResBody> Service<Request<ReqBody>> for FollowRedirectService<S>
where
    S: Service<Request<ReqBody>, Response = Response<ResBody>> + Clone + Send + 'static,
    S::Future: Send + 'static,
    S::Error: std::error::Error + Send + Sync + 'static,
    ReqBody: Clone + Send + 'static,
    ResBody: Send + 'static,
{
    type Response = S::Response;
    type Error = S::Error;
    type Future = Pin<Box<dyn Future<Output = Result<Self::Response, Self::Error>> + Send>>;

    fn poll_ready(&mut self, cx: &mut Context<'_>) -> Poll<Result<(), Self::Error>> {
        self.inner.poll_ready(cx)
    }

    fn call(&mut self, req: Request<ReqBody>) -> Self::Future {
        let mut inner = self.inner.clone();
        let max_redirects = self.max_redirects;

        Box::pin(async move {
            let mut current_req = req;
            let mut attempts = 0;

            loop {
                // Clone request to retry if needed
                let req_clone = current_req.clone();
                let response = inner.call(current_req).await?;

                if attempts >= max_redirects {
                    return Ok(response);
                }

                let status = response.status();
                if status.is_redirection()
                    && let Some(location) = response.headers().get(http::header::LOCATION)
                    && let Ok(loc_str) = location.to_str()
                {
                    // Resolve new URI
                    let new_uri = if let Ok(parsed) = loc_str.parse::<Uri>() {
                        let parts = parsed.into_parts();
                        let mut builder = Uri::builder();

                        // Inherit scheme/authority from original request if missing (relative redirect)
                        if let Some(scheme) = parts.scheme {
                            builder = builder.scheme(scheme);
                        } else if let Some(s) = req_clone.uri().scheme() {
                            builder = builder.scheme(s.clone());
                        }

                        if let Some(authority) = parts.authority {
                            builder = builder.authority(authority);
                        } else if let Some(a) = req_clone.uri().authority() {
                            builder = builder.authority(a.clone());
                        }

                        if let Some(pq) = parts.path_and_query {
                            builder = builder.path_and_query(pq);
                        }

                        builder.build().unwrap_or_else(|_| req_clone.uri().clone())
                    } else {
                        // Invalid location header, stop redirecting
                        return Ok(response);
                    };

                    // --- SECURITY CHECK: Same Origin Only ---
                    // Since the inner service (DynamicAuth) attaches credentials blindly,
                    // we MUST ensure we do not redirect to a different host.
                    let original_uri = req_clone.uri();

                    let same_scheme = new_uri.scheme() == original_uri.scheme();
                    let same_auth = new_uri.authority() == original_uri.authority();

                    if !same_scheme || !same_auth {
                        // Cross-origin redirect detected.
                        // Stop following to prevent leaking credentials to the new host.
                        return Ok(response);
                    }
                    // ----------------------------------------

                    // Update request and retry
                    current_req = req_clone;
                    *current_req.uri_mut() = new_uri;
                    attempts += 1;
                    continue;
                }

                return Ok(response);
            }
        })
    }
}