Dio: Cross-origin redirect leaks sensitive request headers in `dio_http2_adapter`

QFinch assessment

diohttp2adapter follows HTTP Location redirects without stripping sensitive request headers when the redirect target is a different origin. An attacker who can cause any origin server to return a cross-origin 302 redirect receives the victim's Authorization, Cookie, and Proxy-Authorization headers verbatim. This vulnerability has a CVSS v3.1 base score of 7.5 (High) because followRedirects is enabled by default, no authentication is required to exploit it, and the confidentiality impact is high.

Potential impact

This is a sensitive information disclosure vulnerability. Any application that: 1. configures Dio with Http2Adapter, and 2. sends requests carrying Authorization, Cookie, or Proxy-Authorization headers, is affected. Because followRedirects defaults to true and maxRedirects defaults to 5, no additional configuration is needed to trigger the bug. An attacker who controls — or can compromise — any HTTP server that the victim application contacts can issue a 302 redirect to an attacker-owned server and thereby capture the victim's bearer tokens, session cookies, or proxy credentials. The attack requires no prior authentication and is executable over the network with low complexity. Stolen credentials may then be used to impersonate the victim against the original service or any other service that accepts the same token. Affected parties include server-side Dart/Flutter applications and CLI tools that make authenticated HTTP/2 requests through diohttp2adapter.

Technical context

When Dio is configured to use Http2Adapter, the adapter's internal fetch method constructs HTTP/2 request headers by unconditionally copying all entries from options.headers: On receiving a 3xx response, the adapter reads the Location header and resolves the redirect target URI: options.copyWith is called without an explicit headers argument; dio/lib/src/options.dart:629 therefore preserves the full original header map via headers ?? Map.from(this.headers). resolveRedirectUri (http2adapter.dart:290) returns an attacker-controlled cross-origin URI without any origin comparison. The combination means that on every redirect, the full set of original sensitive headers — including Authorization, Cookie, and Proxy-Authorization — is forwarded to the new authority with no sanitization. Data flow (source → sink): 1. dio/lib/src/diomixin.dart:383 — public Dio.request<T>(String path, ...) entry point. 2. dio/lib/src/options.dart:331 — base and per-request headers merged into RequestOptions. 3. dio/lib/src/diomixin.dart:596 — httpClientAdapter.fetch(reqOpt, ...) dispatches to Http2Adapter. 4. plugins/http2adapter/lib/src/http2adapter.dart:254 — Location header is read from the network response (attacker-controlled source). 5. plugins/http2adapter/lib/src/http2adapter.dart:258 — redirect target URI resolved; cross-origin check absent. 6. plugins/http2adapter/lib/src/http2adapter.dart:260 — options.copyWith(path: path, ...) called without headers override. 7. dio/lib/src/options.dart:629 — copyWith preserves Map.from(this.headers) — all sensitive headers retained. 8. plugins/http2adapter/lib/src/http2adapter.dart:111 — preserved headers emitted verbatim to the cross-origin HTTP/2 request (sink). Suggested patch — strip sensitive headers before following a cross-origin redirect: