luasocket
luasocket copied to clipboard
limited url redirections
proposal to change behavior of http.request{redirect=bool} to integer. behavior should mimic curls --max-time
Why should the API mimic curl
?
This would be a major change to the current API and there would have to be some significant benefit for it to be considered.
It seems like a security vulnerability, I have not looked at the code, but an infinite redirect could happen.
Looking at the code, it seems there's a max redirect limit of 5. having control of this variable would be nice. but that eases my worries.