3 files changed, 23 insertions, 4 deletions
diff --git a/apt-pkg/acquire-item.cc b/apt-pkg/acquire-item.cc
index 83c793093..755e1fb59 100644
--- a/apt-pkg/acquire-item.cc
+++ b/apt-pkg/acquire-item.cc
@@ -1464,8 +1464,20 @@ bool pkgAcqMetaBase::CheckDownloadDone(pkgAcqTransactionItem * const I, const st
    return true;
 }
 									/*}}}*/
-bool pkgAcqMetaBase::CheckAuthDone(string const &Message)		/*{{{*/
+bool pkgAcqMetaBase::CheckAuthDone(string const &Message, pkgAcquire::MethodConfig const *const Cnf) /*{{{*/
 {
+   /* If we work with a recent version of our gpgv method, we expect that it tells us
+      which key(s) have signed the file so stuff like CVE-2018-0501 is harder in the future */
+   if (Cnf->Version != "1.0" && LookupTag(Message, "Signed-By").empty())
+   {
+      std::string errmsg;
+      strprintf(errmsg, "Internal Error: Signature on %s seems good, but expected details are missing! (%s)", Target.URI.c_str(), "Signed-By");
+      if (ErrorText.empty())
+	 ErrorText = errmsg;
+      Status = StatAuthError;
+      return _error->Error("%s", errmsg.c_str());
+   }
+
    // At this point, the gpgv method has succeeded, so there is a
    // valid signature from a key in the trusted keyring.  We
    // perform additional verification of its contents, and use them
@@ -1946,7 +1958,7 @@ void pkgAcqMetaClearSig::Done(std::string const &Message,
          QueueForSignatureVerify(this, DestFile, DestFile);
       return;
    }
-   else if(CheckAuthDone(Message) == true)
+   else if (CheckAuthDone(Message, Cnf) == true)
    {
       if (TransactionManager->IMSHit == false)
 	 TransactionManager->TransactionStageCopy(this, DestFile, GetFinalFilename());
@@ -2190,7 +2202,7 @@ void pkgAcqMetaSig::Done(string const &Message, HashStringList const &Hashes,
       }
       return;
    }
-   else if(MetaIndex->CheckAuthDone(Message) == true)
+   else if (MetaIndex->CheckAuthDone(Message, Cfg) == true)
    {
       auto const Releasegpg = GetFinalFilename();
       auto const Release = MetaIndex->GetFinalFilename();
diff --git a/apt-pkg/acquire-item.h b/apt-pkg/acquire-item.h
index 4a1378922..70651d9e3 100644
--- a/apt-pkg/acquire-item.h
+++ b/apt-pkg/acquire-item.h
@@ -451,8 +451,9 @@ class APT_HIDDEN pkgAcqMetaBase : public pkgAcqTransactionItem		/*{{{*/
     *
     *  \param Message The message block received from the fetch
     *  subprocess.
+    *  \param Cnf The method and its configuration which handled the request
     */
-   bool CheckAuthDone(std::string const &Message);
+   bool CheckAuthDone(std::string const &Message, pkgAcquire::MethodConfig const *const Cnf);
 
    /** Check if the current item should fail at this point */
    bool CheckStopAuthentication(pkgAcquire::Item * const I, const std::string &Message);
diff --git a/apt-pkg/acquire-method.cc b/apt-pkg/acquire-method.cc
index c9cd48bb6..c67c47ab8 100644
--- a/apt-pkg/acquire-method.cc
+++ b/apt-pkg/acquire-method.cc
@@ -470,6 +470,12 @@ void pkgAcqMethod::Status(const char *Format,...)
  * the worker will enqueue again later on to the right queue */
 void pkgAcqMethod::Redirect(const string &NewURI)
 {
+   if (NewURI.find_first_not_of(" !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~") != std::string::npos)
+   {
+      _error->Error("SECURITY: URL redirect target contains control characters, rejecting.");
+      Fail();
+      return;
+   }
    std::unordered_map<std::string, std::string> fields;
    try_emplace(fields, "URI", Queue->Uri);
    try_emplace(fields, "New-URI", NewURI);