Webcmdlets display an error on https to http redirect by CarloToso · Pull Request #18595 · PowerShell/PowerShell

CarloToso · 2022-11-17T11:03:01Z

PR Summary

At the moment https to http redirect fail silently, after this PR it will show an error.

PR Context

PR Checklist

src/Microsoft.PowerShell.Commands.Utility/resources/WebCmdletStrings.resx

PaulHigin · 2022-11-22T17:59:23Z

...t.PowerShell.Commands.Utility/commands/utility/WebCmdlet/Common/WebRequestPSCmdlet.Common.cs

+                                {
+                                        ErrorRecord er = new(new InvalidOperationException(), "InsecureRedirection", ErrorCategory.InvalidOperation, request);
+                                        er.ErrorDetails = new ErrorDetails(WebCmdletStrings.InsecureRedirection);
+                                        WriteError(er);


Shouldn't this be a terminating error here? There doesn't seem to be any point in continuing and we should throw ThrowTerminatingError() here.

I used WriteError() to mirror the behaviour of lines 1604-1609:

if (WebSession.MaximumRedirection == 0 && IsRedirectCode(response.StatusCode)) // Indicate "HttpClientHandler.AllowAutoRedirect == false" { ErrorRecord er = new(new InvalidOperationException(), "MaximumRedirectExceeded", ErrorCategory.InvalidOperation, request); er.ErrorDetails = new ErrorDetails(WebCmdletStrings.MaximumRedirectionCountExceeded); WriteError(er); }

I can change it if needed.

What is a behavior of other utils in the scenario?

Also text in WebCmdletStrings.InsecureRedirection assumes we should throw.

Test:
Invoke-WebRequest "https://mockbin.org/redirect/308?to=https://mockbin.org/redirect/302?to=http://mockbin.org/status/200" -SkipHttpErrorCheck --> 302
curl -L "https://mockbin.org/redirect/308?to=https://mockbin.org/redirect/302?to=http://mockbin.org/status/200" --> 200

(HttpClient does not seem to allow insecure redirect: dotnet/runtime#23801)

Please add new test.

ghost · 2022-11-30T02:01:06Z

This pull request has been automatically marked as Review Needed because it has been there has not been any activity for 7 days.
Maintainer, please provide feedback and/or mark it as Waiting on Author

iSazonov · 2023-01-12T10:39:56Z

@CarloToso Please add tests.

CarloToso · 2023-01-12T10:41:52Z

@iSazonov I'm working on the tests.

iSazonov · 2023-01-12T10:53:03Z

@CarloToso We could add tests in #18546 after current PR will be merged.

CarloToso · 2023-01-13T22:27:15Z

@iSazonov I think we can merge

ghost · 2023-01-23T14:01:00Z

This pull request has been automatically marked as Review Needed because it has been there has not been any activity for 7 days.
Maintainer, please provide feedback and/or mark it as Waiting on Author

CarloToso · 2023-01-30T18:29:15Z

@SteveL-MSFT can we merge this?

pull-request-quantifier-deprecated · 2023-02-10T10:31:05Z

This PR has 17 quantified lines of changes. In general, a change size of upto 200 lines is ideal for the best PR experience!

Quantification details

Label      : Extra Small
Size       : +12 -5
Percentile : 6.8%

Total files changed: 3

Change summary by file extension:
.cs : +4 -0
.resx : +6 -3
.ps1 : +2 -2

Change counts above are quantified counts, based on the PullRequestQuantifier customizations.

Why proper sizing of changes matters

Optimal pull request sizes drive a better predictable PR flow as they strike a
balance between between PR complexity and PR review overhead. PRs within the
optimal size (typical small, or medium sized PRs) mean:

Fast and predictable releases to production:
- Optimal size changes are more likely to be reviewed faster with fewer
  iterations.
- Similarity in low PR complexity drives similar review times.
Review quality is likely higher as complexity is lower:
- Bugs are more likely to be detected.
- Code inconsistencies are more likely to be detected.
Knowledge sharing is improved within the participants:
- Small portions can be assimilated better.
Better engineering practices are exercised:
- Solving big problems by dividing them in well contained, smaller problems.
- Exercising separation of concerns within the code changes.

What can I do to optimize my changes

Use the PullRequestQuantifier to quantify your PR accurately
- Create a context profile for your repo using the context generator
- Exclude files that are not necessary to be reviewed or do not increase the review complexity. Example: Autogenerated code, docs, project IDE setting files, binaries, etc. Check out the Excluded section from your prquantifier.yaml context profile.
- Understand your typical change complexity, drive towards the desired complexity by adjusting the label mapping in your prquantifier.yaml context profile.
- Only use the labels that matter to you, see context specification to customize your prquantifier.yaml context profile.
Change your engineering behaviors
- For PRs that fall outside of the desired spectrum, review the details and check if:
  - Your PR could be split in smaller, self-contained PRs instead
  - Your PR only solves one particular issue. (For example, don't refactor and code new features in the same PR).

How to interpret the change counts in git diff output

One line was added: +1 -0
One line was deleted: +0 -1
One line was modified: +1 -1 (git diff doesn't know about modified, it will
interpret that line like one addition plus one deletion)
Change percentiles: Change characteristics (addition, deletion, modification)
of this PR in relation to all other PRs within the repository.

Was this comment helpful? 👍 :ok_hand: :thumbsdown: (Email)
Customize PullRequestQuantifier for this repository.

Outdated

ghost · 2023-03-14T22:28:58Z

🎉v7.4.0-preview.2 has been released which incorporates this pull request.:tada:

Handy links:

Release Notes

crlogic · 2023-04-06T20:20:40Z

Breaking changes

None

Hrmm, this breaks every IRM across any insecure (corporate|zero-trust) proxies by making AllowInsecureRedirect mandatory (because I cannot control this as an end user). Except I can't perform a blanket "add AllowInsecureRedirect" to all IRM's because agents/executors/etc won't all be upgraded big-bang to 7.4 (rolling upgrades).

Script modules are now completely broken if there is a insecure proxy. Wouldn't that make this a breaking change?
https://github.com/dell/OpenManage-PowerShell-Modules

Is there an easier way?

    if ($psVersionTable.PSVersion.Major -ge 7 -and $psVersionTable.PSVersion.Minor -ge 4) {
        $querySplat.Add('AllowInsecureRedirect',$true)
    }

GitHub
GitHub - dell/OpenManage-PowerShell-Modules
Contribute to dell/OpenManage-PowerShell-Modules development by creating an account on GitHub.

CarloToso · 2023-04-06T21:06:41Z

@crlogic Could you please open an issue to discuss this?

CarloToso added 3 commits November 17, 2022 11:18

Detect insecure redirection

365557c

Add error

b1f702c

Better error

ba11ffe

CarloToso requested a review from PaulHigin as a code owner November 17, 2022 11:03

pull-request-quantifier-deprecated bot added the Extra Small label Nov 17, 2022

ghost assigned anmenaga Nov 17, 2022

CarloToso changed the title ~~Webcmdlets display an error on https to http redirect~~ WIP: Webcmdlets display an error on https to http redirect Nov 17, 2022

Fix error message

aa403e5

CarloToso changed the title ~~WIP: Webcmdlets display an error on https to http redirect~~ Webcmdlets display an error on https to http redirect Nov 17, 2022

iSazonov reviewed Nov 17, 2022

View reviewed changes

src/Microsoft.PowerShell.Commands.Utility/resources/WebCmdletStrings.resx Outdated Show resolved Hide resolved

CarloToso added 2 commits November 17, 2022 19:56

Reword Error

2bb1cee

Merge branch 'PowerShell:master' into check-for-https-->http-redirect

5fb1a44

PaulHigin previously requested changes Nov 22, 2022

View reviewed changes

ghost added Waiting on Author The PR was reviewed and requires changes or comments from the author before being accept and removed Waiting on Author The PR was reviewed and requires changes or comments from the author before being accept labels Nov 22, 2022

ghost added the Review - Needed The PR is being reviewed label Nov 30, 2022

CarloToso requested review from PaulHigin and iSazonov and removed request for PaulHigin and iSazonov January 9, 2023 14:36

CarloToso added 2 commits January 9, 2023 18:12

Merge branch 'PowerShell:master' into check-for-https-->http-redirect

9ec8a57

WriteError -> ThrowTerminatingError

3f33a24

iSazonov added Breaking-Change breaking change that may affect users CL-General Indicates that a PR should be marked as a general cmdlet change in the Change Log and removed Breaking-Change breaking change that may affect users labels Jan 9, 2023

ghost removed the Review - Needed The PR is being reviewed label Jan 9, 2023

CarloToso mentioned this pull request Jan 13, 2023

Add tests for Allowinsecureredirect parameter in Web cmdlets #18939

Merged

CarloToso added 3 commits January 13, 2023 19:38

Merge branch 'PowerShell:master' into check-for-https-->http-redirect

972acf9

Update and add !AllowInsecureRedirect

6ad7fc9

fix tests

11d6ed9

fix test error

38269a7

iSazonov approved these changes Jan 14, 2023

View reviewed changes

iSazonov closed this Jan 14, 2023

iSazonov reopened this Jan 14, 2023

iSazonov requested a review from PaulHigin January 14, 2023 07:38

ghost added the Review - Needed The PR is being reviewed label Jan 23, 2023

CarloToso mentioned this pull request Jan 23, 2023

Invoke-WebRequest/Invoke-RestMethod doesn't error silently and doesn't return object #16247

Closed

5 tasks

iSazonov requested a review from SteveL-MSFT January 31, 2023 05:34

Merge branch 'master' into check-for-https-->http-redirect

1508806

SteveL-MSFT approved these changes Feb 13, 2023

View reviewed changes

iSazonov assigned iSazonov and unassigned anmenaga Feb 14, 2023

ghost removed the Review - Needed The PR is being reviewed label Feb 14, 2023

iSazonov merged commit 69a4d79 into PowerShell:master Feb 14, 2023

CarloToso deleted the check-for-https-->http-redirect branch February 14, 2023 10:36

crlogic mentioned this pull request Apr 6, 2023

Insecure Proxy Behavior with Invoke-(RestMethod|WebRequest) on 7.4.0-preview2 #19461

Closed

5 tasks

CarloToso mentioned this pull request Apr 7, 2023

WebCmdlets check if absolute uri before checking scheme #19468

Merged

22 tasks

Conversation

CarloToso commented Nov 17, 2022 • edited by iSazonov Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

PR Context

PR Checklist

Uh oh!

Uh oh!

PaulHigin Nov 22, 2022

Choose a reason for hiding this comment

Uh oh!

CarloToso Nov 22, 2022

Choose a reason for hiding this comment

Uh oh!

iSazonov Jan 9, 2023

Choose a reason for hiding this comment

Uh oh!

iSazonov Jan 9, 2023

Choose a reason for hiding this comment

Uh oh!

CarloToso Jan 9, 2023

Choose a reason for hiding this comment

Uh oh!

iSazonov Jan 9, 2023

Choose a reason for hiding this comment

Uh oh!

ghost commented Nov 30, 2022

Uh oh!

iSazonov commented Jan 12, 2023

Uh oh!

CarloToso commented Jan 12, 2023 • edited by iSazonov Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

iSazonov commented Jan 12, 2023

Uh oh!

CarloToso commented Jan 13, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ghost commented Jan 23, 2023

Uh oh!

CarloToso commented Jan 30, 2023

Uh oh!

pull-request-quantifier-deprecated bot commented Feb 10, 2023

What can I do to optimize my changes

How to interpret the change counts in git diff output

Uh oh!

ghost commented Mar 14, 2023

Uh oh!

crlogic commented Apr 6, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

CarloToso commented Apr 6, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

CarloToso commented Nov 17, 2022 •

edited by iSazonov

Loading

CarloToso commented Jan 12, 2023 •

edited by iSazonov

Loading

CarloToso commented Jan 13, 2023 •

edited

Loading

crlogic commented Apr 6, 2023 •

edited

Loading