Repository navigation
fix(runtime): pin OTP releases that drop credentials on cross-origin redirect - #1035
Conversation
…redirect Erlang/OTP before 27.3.4.13 makes :httpc resend the authorization header to whatever host a redirect names. Measured on 2026-11-09 with a local redirect probe (301/302/303/307/308, GET and POST, other port and other host): 27.0.1, 27.3.4.4 and 27.3.4.12 forwarded it in all 20 cross-origin cases; 27.3.4.13, 27.3.4.19 and 28.5.0.8 dropped it in all 20. - mise.toml: erlang 27.3.4.4 -> 27.3.4.19 (latest 27 patch). - tests.yml (3 lanes) and merge-orchestrate.yml: otp-version 27.0 -> 27.3.4.19, so the test lanes run the release the runtime pins. - test/httpc_redirect_credentials_test.exs: 10 cross-origin cases must not see the header; a same-origin control must. It passes on 27.3.4.19 and fails all 10 cross-origin cases on 27.3.4.4. The two echidnabot senders already set autoredirect: false; this covers every other :httpc caller through the runtime pin. Not changed: the 28.3 lanes in ci.yml and rsr-oracle.yml, which are pinned to match the estate dogfood gate (28.3 also forwards); they need a coordinated estate change. Full suite on Elixir 1.17.3 / OTP 27.3.4.19: 2699 tests, 0 failures, 246 excluded. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01J4QvDgzT72Tq2HTJmikyNg
|
Caution Review failedThe pull request is closed. Summary
Merge Risk:
 |
Codex Review Summary: ❌ FailedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
This security review couldn’t start because the paying account has exhausted its Codex allowance and has insufficient available credits. The payer can check their balance and add credits in the Codex usage dashboard, then try again. If you do not manage the paying account, contact this repository's admins. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d0dce62819
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # Language runtimes | ||
| # Match the OTP 27 / Elixir 1.17 test lane in .github/workflows/tests.yml. | ||
| erlang = "27.3.4.4" | ||
| erlang = "27.3.4.19" # >= 27.3.4.13: :httpc drops authorization on cross-origin redirect |
There was a problem hiding this comment.
When a configured service URL embeds credentials (for example, HYPATIA_VERISIM_URL=http://user:pass@host), versions 27.3.4.13–18 still forward that userinfo to a cross-origin redirect; this remaining CVE-2026-48856 case was only fixed in 27.3.4.19, as documented in the OTP 27.3.4.19 release notes. Because Hypatia.ServiceUrl.present/1 accepts such URLs unchanged and the new test supplies only an explicit Authorization header, downgrading according to this >= 27.3.4.13 comment would make the test pass while credentials still leak. State 27.3.4.19 as the minimum and cover URL userinfo in the regression test.
Useful? React with 👍 / 👎.
| # already set `autoredirect: false`; this test fails if the runtime itself | ||
| # regresses, so every other `:httpc` caller stays covered. |
There was a problem hiding this comment.
When Hypatia runs outside the newly pinned mise/workflow lanes, this does not keep every caller covered: the public Hypatia.Reviewer.review_pr/3 path sends GITHUB_TOKEN in lib/hypatia/reviewer.ex with httpc's default autoredirect: true, while the repository still documents and provisions OTP 28.3 in .github/workflows/ci.yml and .github/workflows/rsr-oracle.yml, a version the change itself identifies as vulnerable. An API redirect to another host in that supported runtime therefore forwards the token despite this test passing only in the pinned OTP 27 lanes; disable automatic redirects or implement origin-checked redirects in each credentialed caller rather than relying solely on development and CI runtime pins.
Useful? React with 👍 / 👎.
|
This security review couldn’t start because the paying account has exhausted its Codex allowance and has insufficient available credits. The payer can check their balance and add credits in the Codex usage dashboard, then try again. If you do not manage the paying account, contact this repository's admins. |
|
Summary
Erlang/OTP releases before 27.3.4.13 make
:httpcresend theauthorizationheader to whatever host a redirect names. Hypatia pinned 27.3.4.4 inmise.tomland ran its test lanes on 27.0, and both are affected.I measured this on 2026-11-09 with a local probe: five redirect codes (301, 302, 303, 307, 308), GET and POST, to another port and to another host. That is 20 cross-origin cases per release:
The two echidnabot senders already set
autoredirect: false(#1010). This change covers every other:httpccaller through the runtime pin.Changes
mise.toml: erlang 27.3.4.4 → 27.3.4.19, the latest 27 patch.tests.yml(three lanes) andmerge-orchestrate.yml:otp-version27.0 → 27.3.4.19, so the test lanes run the release that the runtime pins.test/httpc_redirect_credentials_test.exs:Not changed
The 28.3 lanes in
ci.ymlandrsr-oracle.ymlare deliberately kept identical to the estate dogfood gate. 28.3 also forwards the header (and 28.3.3 as well; 28.5.0.8 does not). Moving them needs a coordinated estate change across the dogfood gates and the standards reusable workflows; it is left to a separate decision.Testing
mix format --check-formattedis clean on the new file.Generated by Claude Code