Bump httpie from 1.0.2 to 1.0.3

[dependabot]

Bumps httpie from 1.0.2 to 1.0.3.

Release notes

Sourced from httpie's releases.

HTTPie 1.0.3

Fixed CVE-2019-10751 — the way the output filename is generated for --download requests without --output resulting in a redirect has been changed to only consider the initial URL as the base for the generated filename, and not the final one. This fixes a potential security issue under the following scenario:

1. A --download request with no explicit --output is made (e.g., $ http -d example.org/file.txt), instructing HTTPie to generate the output filename from the Content-Disposition response header, or from the URL if the header is not provided.
2. The server handling the request has been modified by an attacker and instead of the expected response the URL returns a redirect to another URL, e.g., attacker.example.org/.bash_profile, whose response does not provide a Content-Disposition header (i.e., the base for the generated filename becomes .bash_profile instead of file.txt).
3. Your current directory doesn’t already contain .bash_profile (i.e., no unique suffix is added to the generated filename).
4. You don’t notice the potentially unexpected output filename as reported by HTTPie in the console output (e.g., Downloading 100.00 B to ".bash_profile").

Changelog

Sourced from httpie's changelog.

1.0.3_ (2019-08-26)

• Fixed CVE-2019-10751 — the way the output filename is generated for --download requests without --output resulting in a redirect has been changed to only consider the initial URL as the base for the generated filename, and not the final one. This fixes a potential security issue under the following scenario:

  1. A --download request with no explicit --output is made (e.g., $ http -d example.org/file.txt), instructing httpie to generate the output filename <https://httpie.org/doc#downloaded-filename>_ from the Content-Disposition response header, or from the URL if the header is not provided.
  2. The server handling the request has been modified by an attacker and instead of the expected response the URL returns a redirect to another URL, e.g., attacker.example.org/.bash_profile, whose response does not provide a Content-Disposition header (i.e., the base for the generated filename becomes .bash_profile instead of file.txt).
  3. Your current directory doesn’t already contain .bash_profile (i.e., no unique suffix is added to the generated filename).
  4. You don’t notice the potentially unexpected output filename as reported by httpie in the console output (e.g., Downloading 100.00 B to ".bash_profile").

  Reported by Raul Onitza and Giulio Comi.

Commits

• 747be30 1.0.3
• 88a9583 Update CHANGELOG.rst
• fd6e879 README
• 6dee493 Fix comments
• df36d62 Changed the way the output filename is generated
• e92b831 Create FUNDING.yml
• fd44f1a Updated Readme to fix a typo (#767)
• b630954 Add a bash here string example
• 3a46149 Fix several ResourceWarning: unclosed file (#741)
• b7c8bf0 Add animation by @​loranallensmith
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

[dependabot]

Superseded by #7.