apt/test/integration/test-cve-2019-3462-dequote-injection, branch master

Implement encoded URI handling in all methods

2020-12-18T18:31:19Z

Every method opts in to getting the encoded URI passed along while keeping compat in case we are operated by an older acquire system. Effectively this is just a change for the http-based methods as the others just decode the URI as they work with files directly.

Proper URI encoding for config requests to our test webserver

2020-12-18T18:02:05Z

Our http method encodes the URI again which results in the double encoding we have unwrap in the webserver (we did already, but we skip the filename handling now which does the first decode).

SECURITY UPDATE: content injection in http method (CVE-2019-3462)

2019-01-22T11:50:59Z

This fixes a security issue that can be exploited to inject arbritrary debs or other files into a signed repository as followed: (1) Server sends a redirect to somewhere%0a (where %0a is \n encoded) (2) apt method decodes the redirect (because the method encodes the URLs before sending them out), writting something like somewhere\n into its output (3) apt then uses the headers injected for validation purposes. Regression-Of: c34ea12ad509cb34c954ed574a301c3cbede55ec LP: #1812353