- Every request made with an F-Droid repository's login (entry.jar, index,
APKs), redirects included, now uses the scoped check: same origin and
inside the repository directory by whole plain path segments. A
same-origin redirect elsewhere on the server gets no login.
- _child() refuses file names a server could normalise outside the
repository: double-encoded dots, ';' path parameters, encoded slashes or
backslashes (anything _credentials.path_segments rejects).
- Store page: moveLogin() strips the login from the address with plain
text matching first, then decodes with a fallback to the text as typed,
so '100%done', '%FF' or an address the URL parser rejects can no longer
leave the password in the field.
Tests: outgoing headers for '%252e%252e/...' and '..;/...' payloads and a
same-origin redirect outside the repository carry no Authorization; the
page test covers undecodable and unparseable logins.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
