fix(backfill): preserve explicit redirect ports (#80)

Signed-off-by: Thomas Albrecht <241560317+thequantumfalcon@users.noreply.github.com>

Author: thequantumfalcon

examples/backfill_github.py

@@ -62,7 +62,8 @@ def redirect_request(self, req, fp, code, msg, headers, newurl):
         if (old_origin is None or new_origin is None
                 or old_origin[0] != "https" or new_origin[0] != "https"
                 or old_origin[1] is None or old_origin[1] != new_origin[1]
-                or (old_origin[2] or 443) != (new_origin[2] or 443)):
+                or (old_origin[2] if old_origin[2] is not None else 443)
+                != (new_origin[2] if new_origin[2] is not None else 443)):
             raise urllib.error.URLError("unsafe GitHub API redirect")
         return super().redirect_request(req, fp, code, msg, headers, newurl)
 

tests/test_regressions_round17_backfill_layout.py

@@ -206,6 +206,41 @@ def test_github_authorization_cannot_cross_a_redirect_boundary(
             request, None, 302, "Found", {}, destination)
 
 
+@pytest.mark.parametrize(
+    ("source", "destination", "allowed"),
+    [
+        ("https://api.github.com/repos/o/r",
+         "https://api.github.com:443/repos/o/r", True),
+        ("https://api.github.com:443/repos/o/r",
+         "https://api.github.com/repos/o/r", True),
+        ("https://api.github.com/repos/o/r",
+         "https://api.github.com:0/repos/o/r", False),
+        ("https://api.github.com:0/repos/o/r",
+         "https://api.github.com/repos/o/r", False),
+        ("https://api.github.com:8443/repos/o/r",
+         "https://api.github.com:8443/repositories/4242", True),
+        ("https://api.github.com:0/repos/o/r",
+         "https://api.github.com:0/repositories/4242", True),
+    ],
+)
+def test_redirect_port_identity_is_not_truthiness(
+        backfill, source, destination, allowed):
+    request = urllib.request.Request(
+        source, headers={"Authorization": "Bearer secret"})
+
+    if not allowed:
+        with pytest.raises(
+                urllib.error.URLError, match="unsafe GitHub API redirect"):
+            backfill._SameOriginRedirectHandler().redirect_request(
+                request, None, 302, "Found", {}, destination)
+        return
+
+    redirected = backfill._SameOriginRedirectHandler().redirect_request(
+        request, None, 302, "Found", {}, destination)
+    assert redirected.full_url == destination
+    assert redirected.get_header("Authorization") == "Bearer secret"
+
+
 def test_same_origin_https_redirect_remains_usable(backfill):
     request = urllib.request.Request(
         "https://api.github.com/repos/octo/demo",