From cf2d69eca19163966018d11a0266398d484bbcdb Mon Sep 17 00:00:00 2001 From: Roger Xu Date: Tue, 29 Jun 2021 16:08:31 -0400 Subject: [PATCH] Handle possibility of relative redirect URLs --- lib/HttpClient.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/HttpClient.ts b/lib/HttpClient.ts index 2e0f519c..2b5406cc 100644 --- a/lib/HttpClient.ts +++ b/lib/HttpClient.ts @@ -286,7 +286,7 @@ export class HttpClient implements ifm.IHttpClient { // if there's no location to redirect to, we won't break; } - let parsedRedirectUrl = url.parse(redirectUrl); + let parsedRedirectUrl = new URL(redirectUrl, requestUrl); if (parsedUrl.protocol == 'https:' && parsedUrl.protocol != parsedRedirectUrl.protocol && !this._allowRedirectDowngrade) { throw new Error("Redirect from HTTPS to HTTP protocol. This downgrade is not allowed for security reasons. If you want to allow this behavior, set the allowRedirectDowngrade option to true."); }