gitproto: refuse cross-host helper-auth retry when TLS verification is off

8936908→main·

Soph·1mo ago·3 files·+162 added/-6 removed

Closes the SkipTLSVerify × redirecting-endpoint × credential-helper interaction: with cert validation disabled, the post-redirect host could be a MITM presenting any self-signed cert for the host the helper would Lookup creds against. Sending the user's stored credentials there is exactly the leak the rest of the redirect-aware fix was designed to prevent — so when InsecureSkipTLSVerify is on we bail out of the cross-host paths before any helper traffic happens and let the 401 surface.

Specifically:

• tryHelperRetry: when the 401 came from a host different from c.EndpointURL.Host and InsecureSkipTLSVerify is true, return res as-is (no Lookup, no retry, no Approve/Reject).
• EnsureAuthForService: same gate after the anonymous probe. Anonymous probes are still allowed to follow the redirect (no creds to leak), but the 401 doesn't lead to attaching anything.
• Same-host 401s are unaffected: the user already accepted that host when they configured the sync, so SkipTLSVerify being on doesn't introduce new exposure on the retry there.

New HTTPConn.InsecureSkipTLSVerify field; syncer plumbs raw.SkipTLSVerify into it whenever the connection is built (mirroring how it's already plumbed into the HTTP transport).

Tests:

• TestRequestInfoRefs_CrossHostRedirectWithSkipTLSVerifyRefusesToSendCreds — asserts 0 Lookup/Approve/Reject calls, no Authorization header on any RoundTrip, c.EndpointURL unchanged, and the 401 surfaces to the caller.
• TestRequestInfoRefs_SameHostUnauthorizedWithSkipTLSVerifyStillRetries — the gate is targeted: same-host retries still work with TLS verification off.
• TestEnsureAuthForService_CrossHostProbeWithSkipTLSVerifyDoesNotAttach — EnsureAuthForService variant.

Code Example

// callers that rely on Endpoint being stable.
FollowInfoRefsRedirect bool

// InsecureSkipTLSVerify mirrors the same-named transport setting and
// must be set by callers whenever the HTTP client they pass in has
// TLS verification disabled. The credential-helper retry path uses it
// to refuse cross-host operations: with TLS verification off there's
// no way to know whether a redirect's destination is the host the
// user trusts or a MITM impersonating it, so sending the helper's
// stored credentials there is unsafe. Same-host 401s (no redirect)
// still retry — the user has accepted whatever host they configured.
InsecureSkipTLSVerify bool

// ProgressOut is the destination for verbose sideband progress
// messages ("Enumerating objects: ...", "Resolving deltas: ..."
// streamed by upload-pack and receive-pack). Nil falls back to