From 7f15eb940ec3428b1373434e39dc82105ca06f6f Mon Sep 17 00:00:00 2001 From: MrCreosote Date: Fri, 28 Aug 2026 13:49:33 -0700 Subject: [PATCH] Don't allow redirects when contacting the CTS from NERSC Had a weird blip where it seemed like a test requestcatcher.com url was redirected to ipv4.games, with an expired cert, which caused the download to NERSC task to fail. Can't reproduce, but disallowing and logging redirects anyway. --- cdmtaskservice/nersc/remote.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/cdmtaskservice/nersc/remote.py b/cdmtaskservice/nersc/remote.py index eb8c608..9d72567 100644 --- a/cdmtaskservice/nersc/remote.py +++ b/cdmtaskservice/nersc/remote.py @@ -108,7 +108,9 @@ def _error_wrapper(func: Callable, args: list[str], result_file_path: str, callb callback_file = cf.parent / f"{cf.stem}.callback_error{cf.suffix}" try: # may want some retries here, halting on incorrect job state messages - ret = requests.get(callback_url) + # Redirects are disallowed since the callback target is dynamically supplied and + # a redirect could be used to route the request to an arbitrary, untrusted host. + ret = requests.get(callback_url, allow_redirects=False) if ret.status_code < 200 or ret.status_code > 299: failed = True # log callback errors for debugging purposes, service will never see this @@ -118,6 +120,7 @@ def _error_wrapper(func: Callable, args: list[str], result_file_path: str, callb "result": "fail", "callback_text": ret.text, "callback_code": ret.status_code, + "callback_redirect_location": ret.headers.get("Location"), "cts_env": cts_env } json.dump(j, f, indent=4)