Follow redirects to permit distributed downloads via GitHub

[rullzer]

I tried to offer the downloads from github (to have faster downloads for all).
But the 302 is not followed.

[tacruc]

Is it solved by
adding CURLOPT_MAXREDIRS and CURLOPT_FOLLOWLOCATION in

updater/lib/Updater.php

Line 480 in e490062

curl_setopt_array($curl, [

?

From a theoretical point of view this looks promising, but I don't know how to test this.

[MorrisJobke]

@LukasReschke Do you think this has any other implications?

[MorrisJobke]

I would add it to the actual download here:

updater/lib/Updater.php

Line 537 in e490062

CURLOPT_USERAGENT => 'Nextcloud Updater',

[MorrisJobke]

I will have a look at this later.

[LukasReschke]

So this could lead to some SSRF concerns in case there is ever a malicious URL being delivered. But at this point we have a bigger concern regardless. Should be fine to adjust IMO.

[jospoortvliet]

So this could lead to some SSRF concerns in case there is ever a malicious URL being delivered. But at this point we have a bigger concern regardless. Should be fine to adjust IMO.

isn't that what signatures are for?

[LukasReschke]

@jospoortvliet The SSRF concern is different :-) - That means I can execute HTTP requests within your network. For example I could send a request to "internal-service/admin?action=malicious_stuff". (and such things are indeed a thing...)

The signature is only for the downloaded blob. But at that point the request is done.

But I guess we can just assume that GitHub won't do this malicious thing, and if they get hacked, we have bigger troubles...

[LukasReschke]

As discussed in chat we should also consider to have a fallback resource in case GitHub cannot be resolved. (e.g. in case ones IP is blocked by GitHub or such)

[MorrisJobke]

@jospoortvliet The SSRF concern is different :-) - That means I can execute HTTP requests within your network. For example I could send a request to "internal-service/admin?action=malicious_stuff". (and such things are indeed a thing...)

Should we just do some whitelisted domains? But this would break self hosted updater servers.