{"action":"created","issue":{"url":"https://api.github.com/repos/caskroom/homebrew-cask/issues/10377","labels_url":"https://api.github.com/repos/caskroom/homebrew-cask/issues/10377/labels{/name}","comments_url":"https://api.github.com/repos/caskroom/homebrew-cask/issues/10377/comments","events_url":"https://api.github.com/repos/caskroom/homebrew-cask/issues/10377/events","html_url":"https://github.com/caskroom/homebrew-cask/issues/10377","id":65972035,"number":10377,"title":"Executable code loaded over an insecure channel (High Risk)","user":{"login":"TheRook","id":521783,"avatar_url":"https://avatars.githubusercontent.com/u/521783?v=3","gravatar_id":"","url":"https://api.github.com/users/TheRook","html_url":"https://github.com/TheRook","followers_url":"https://api.github.com/users/TheRook/followers","following_url":"https://api.github.com/users/TheRook/following{/other_user}","gists_url":"https://api.github.com/users/TheRook/gists{/gist_id}","starred_url":"https://api.github.com/users/TheRook/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/TheRook/subscriptions","organizations_url":"https://api.github.com/users/TheRook/orgs","repos_url":"https://api.github.com/users/TheRook/repos","events_url":"https://api.github.com/users/TheRook/events{/privacy}","received_events_url":"https://api.github.com/users/TheRook/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":13,"created_at":"2015-04-02T17:23:25Z","updated_at":"2015-04-03T15:13:07Z","closed_at":null,"body":"When downloading executable code from SourceForge brew choose to use an insecure channel (http), which is vulnerable to a man-in-the-middle attack. The transmission of executable code over HTTP is extremely hazardous as it leads to remote code execution. The following insecure behavior was observed:\r\n\r\n```\r\n~> brew install Caskroom/cask/filezilla\r\n==> brew cask install Caskroom/cask/filezilla\r\n==> Downloading http://downloads.sourceforge.net/project/filezilla/FileZilla_Client/3.10.3/FileZilla_3.10.3_macosx-x86.app.tar.bz2\r\n```\r\n\r\nBrew was installed on one our high security systems. A vulnerability which leads to remote code execution on this system is unacceptable, and we are forced to uninstall brew until this high risk issue is addressed."},"comment":{"url":"https://api.github.com/repos/caskroom/homebrew-cask/issues/comments/89316043","html_url":"https://github.com/caskroom/homebrew-cask/issues/10377#issuecomment-89316043","issue_url":"https://api.github.com/repos/caskroom/homebrew-cask/issues/10377","id":89316043,"user":{"login":"phinze","id":37534,"avatar_url":"https://avatars.githubusercontent.com/u/37534?v=3","gravatar_id":"","url":"https://api.github.com/users/phinze","html_url":"https://github.com/phinze","followers_url":"https://api.github.com/users/phinze/followers","following_url":"https://api.github.com/users/phinze/following{/other_user}","gists_url":"https://api.github.com/users/phinze/gists{/gist_id}","starred_url":"https://api.github.com/users/phinze/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/phinze/subscriptions","organizations_url":"https://api.github.com/users/phinze/orgs","repos_url":"https://api.github.com/users/phinze/repos","events_url":"https://api.github.com/users/phinze/events{/privacy}","received_events_url":"https://api.github.com/users/phinze/received_events","type":"User","site_admin":false},"created_at":"2015-04-03T15:13:07Z","updated_at":"2015-04-03T15:13:07Z","body":"Great discussion here, and very good point @vitorgalvao about why to avoid HTTPS -> HTTP redirecting URLs. I was originally in the \"we should prefer HTTPS in all cases so that we automatically upgrade to the secure pathway when upstream vendors do\", but I see now that it does a disservice to our users to pretend like things are secure when they are not.\r\n\r\nI was actually going down a road very similar to the one @radeksimko described with the check above (enhancing the `brew cask _checkurl` codepath).\r\n\r\nAnother possible approach that just came to mind:\r\n\r\n * Always prefer HTTPS URLs in casks\r\n * Show the user a warning when an HTTPS URL redirects to an HTTP URL\r\n\r\nPros:\r\n\r\n * Less manual polling for upgradable URLs\r\n * Promotes to all users the bad security practice of HTTPS -> HTTP redirects, potentially putting more pressure on vendors\r\n * Because the messaging happens at runtime, less overhead in explaining the policy via rejections of \"http\" -> \"https\" PRs\r\n\r\nCons:\r\n\r\n * Static analysis of Casks is potentially misleading about how many are truly secure.\r\n\r\nWhat do you think?"}}