From c480c032ff2c0ac83d9627388549b8e1bfd43cf8 Mon Sep 17 00:00:00 2001
From: Mikhail Filippov <mikhail@filippov.me>
Date: Fri, 28 Oct 2022 20:05:37 +0400
Subject: [PATCH] RIDER-84095 Manual follow redirects to avoid leak
 Authorization header into redirected request.

GitOrigin-RevId: 8d56c83a28f63295861e4b3deff74f42c4d9339c
---
 .../BuildDependenciesDownloader.java            | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/platform/build-scripts/downloader/src/org/jetbrains/intellij/build/dependencies/BuildDependenciesDownloader.java b/platform/build-scripts/downloader/src/org/jetbrains/intellij/build/dependencies/BuildDependenciesDownloader.java
index 1c59332240fd..4edd42f187b4 100644
--- a/platform/build-scripts/downloader/src/org/jetbrains/intellij/build/dependencies/BuildDependenciesDownloader.java
+++ b/platform/build-scripts/downloader/src/org/jetbrains/intellij/build/dependencies/BuildDependenciesDownloader.java
@@ -29,6 +29,7 @@ import java.time.Instant;
 import java.util.Arrays;
 import java.util.List;
 import java.util.Map;
+import java.util.Optional;
 import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.concurrent.atomic.AtomicInteger;
 import java.util.concurrent.locks.Lock;
@@ -59,7 +60,7 @@ public final class BuildDependenciesDownloader {
 
   // init is very expensive due to SSL initialization
   private static final class HttpClientHolder {
-    private static final HttpClient httpClient = HttpClient.newBuilder().followRedirects(HttpClient.Redirect.NORMAL)
+    private static final HttpClient httpClient = HttpClient.newBuilder().followRedirects(HttpClient.Redirect.NEVER)
       .version(HttpClient.Version.HTTP_1_1).build();
   }
 
@@ -379,6 +380,20 @@ public final class BuildDependenciesDownloader {
 
     HttpResponse<Path> response = HttpClientHolder.httpClient.send(request, HttpResponse.BodyHandlers.ofFile(tempFile));
     int statusCode = response.statusCode();
+
+    if (statusCode == 301 || statusCode == 302 || statusCode == 307 || statusCode == 308) {
+      Optional<String> locationHeader = response.headers().firstValue("Location");
+      if (locationHeader.isPresent()) {
+        requestBuilder = HttpRequest.newBuilder()
+          .GET()
+          .uri(new URI(locationHeader.get()))
+          .setHeader("User-Agent", "Build Script Downloader");
+        request = requestBuilder.build();
+        response = HttpClientHolder.httpClient.send(request, HttpResponse.BodyHandlers.ofFile(tempFile));
+        statusCode = response.statusCode();
+      }
+    }
+
     if (statusCode != 200) {
       StringBuilder builder = new StringBuilder("Cannot download\n");