Do only follow HTTP and HTTPS redirects

We do not want to follow redirects to other protocols since they might allow an adversary to bypass network restrictions. (i.e. a redirect to ftp:// might be used to access files of a FTP server which might be in a secure zone and not be reachable from the net but from the ownCloud server)

Get final redirect manually using get_headers()

Migrate to HTTPHelper class and add unit tests

1 files changed, 6 insertions, 0 deletions

diff --git a/lib/public/iservercontainer.php b/lib/public/iservercontainer.php
index 1abf0d9938d..a093ff3a640 100644
--- a/lib/public/iservercontainer.php
+++ b/lib/public/iservercontainer.php
@@ -242,4 +242,10 @@ interface IServerContainer {
 	 * @return \OCP\IEventSource
 	 */
 	function createEventSource();
+
+	/**
+	 * Returns an instance of the HTTP helper class
+	 * @return \OC\HTTPHelper
+	 */
+	function getHTTPHelper();
 }