new file mode 100644
@@ -0,0 +1,139 @@
+From 85c5227eef7370832044eb918e8a99c0bcbab86f Mon Sep 17 00:00:00 2001
+From: Patrick Griffis <pgriffis@igalia.com>
+Date: Wed, 5 Feb 2025 16:18:10 -0600
+Subject: [PATCH] session: Strip authentication credentails on cross-origin
+ redirect
+
+This should match the behavior of Firefox and Safari but not of Chromium.
+
+CVE: CVE-2025-46421
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/436/diffs?commit_id=3e5c26415811f19e7737238bb23305ffaf96f66b]
+
+Signed-off-by: Changqing Li <changqing.li@windriver.com>
+---
+ libsoup/soup-session.c | 6 ++++
+ tests/auth-test.c | 77 ++++++++++++++++++++++++++++++++++++++++++
+ 2 files changed, 83 insertions(+)
+
+diff --git a/libsoup/soup-session.c b/libsoup/soup-session.c
+index 631bec0..9f00b05 100644
+--- a/libsoup/soup-session.c
++++ b/libsoup/soup-session.c
+@@ -1230,6 +1230,12 @@ soup_session_redirect_message (SoupSession *session,
+ SOUP_ENCODING_NONE);
+ }
+
++ /* Strip all credentials on cross-origin redirect. */
++ if (!soup_uri_host_equal (soup_message_get_uri (msg), new_uri)) {
++ soup_message_headers_remove_common (soup_message_get_request_headers (msg), SOUP_HEADER_AUTHORIZATION);
++ soup_message_set_auth (msg, NULL);
++ }
++
+ soup_message_set_request_host_from_uri (msg, new_uri);
+ soup_message_set_uri (msg, new_uri);
+ g_uri_unref (new_uri);
+diff --git a/tests/auth-test.c b/tests/auth-test.c
+index 484097f..7c3b551 100644
+--- a/tests/auth-test.c
++++ b/tests/auth-test.c
+@@ -1,6 +1,7 @@
+ /* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 8 -*- */
+
+ #include "test-utils.h"
++#include "soup-uri-utils-private.h"
+
+ static const char *base_uri;
+ static GMainLoop *loop;
+@@ -1916,6 +1917,81 @@ do_missing_params_test (gconstpointer auth_header)
+ soup_test_server_quit_unref (server);
+ }
+
++static void
++redirect_server_callback (SoupServer *server,
++ SoupServerMessage *msg,
++ const char *path,
++ GHashTable *query,
++ gpointer user_data)
++{
++ static gboolean redirected = FALSE;
++
++ if (!redirected) {
++ char *redirect_uri = g_uri_to_string (user_data);
++ soup_server_message_set_redirect (msg, SOUP_STATUS_MOVED_PERMANENTLY, redirect_uri);
++ g_free (redirect_uri);
++ redirected = TRUE;
++ return;
++ }
++
++ g_assert_not_reached ();
++}
++
++static gboolean
++auth_for_redirect_callback (SoupMessage *msg, SoupAuth *auth, gboolean retrying, gpointer user_data)
++{
++ GUri *known_server_uri = user_data;
++
++ if (!soup_uri_host_equal (known_server_uri, soup_message_get_uri (msg)))
++ return FALSE;
++
++ soup_auth_authenticate (auth, "user", "good-basic");
++
++ return TRUE;
++}
++
++static void
++do_strip_on_crossorigin_redirect (void)
++{
++ SoupSession *session;
++ SoupMessage *msg;
++ SoupServer *server1, *server2;
++ SoupAuthDomain *auth_domain;
++ GUri *uri;
++ gint status;
++
++ server1 = soup_test_server_new (SOUP_TEST_SERVER_IN_THREAD);
++ server2 = soup_test_server_new (SOUP_TEST_SERVER_IN_THREAD);
++
++ /* Both servers have the same credentials. */
++ auth_domain = soup_auth_domain_basic_new ("realm", "auth-test", "auth-callback", server_basic_auth_callback, NULL);
++ soup_auth_domain_add_path (auth_domain, "/");
++ soup_server_add_auth_domain (server1, auth_domain);
++ soup_server_add_auth_domain (server2, auth_domain);
++ g_object_unref (auth_domain);
++
++ /* Server 1 asks for auth, then redirects to Server 2. */
++ soup_server_add_handler (server1, NULL,
++ redirect_server_callback,
++ soup_test_server_get_uri (server2, "http", NULL), (GDestroyNotify)g_uri_unref);
++ /* Server 2 requires auth. */
++ soup_server_add_handler (server2, NULL, server_callback, NULL, NULL);
++
++ session = soup_test_session_new (NULL);
++ uri = soup_test_server_get_uri (server1, "http", NULL);
++ msg = soup_message_new_from_uri ("GET", uri);
++ /* The client only sends credentials for the host it knows. */
++ g_signal_connect (msg, "authenticate", G_CALLBACK (auth_for_redirect_callback), uri);
++
++ status = soup_test_session_send_message (session, msg);
++
++ g_assert_cmpint (status, ==, SOUP_STATUS_UNAUTHORIZED);
++
++ g_uri_unref (uri);
++ soup_test_server_quit_unref (server1);
++ soup_test_server_quit_unref (server2);
++}
++
+ int
+ main (int argc, char **argv)
+ {
+@@ -1949,6 +2025,7 @@ main (int argc, char **argv)
+ g_test_add_func ("/auth/auth-uri", do_auth_uri_test);
+ g_test_add_func ("/auth/cancel-request-on-authenticate", do_cancel_request_on_authenticate);
+ g_test_add_func ("/auth/multiple-algorithms", do_multiple_digest_algorithms);
++ g_test_add_func ("/auth/strip-on-crossorigin-redirect", do_strip_on_crossorigin_redirect);
+ g_test_add_data_func ("/auth/missing-params/realm", "Digest qop=\"auth\"", do_missing_params_test);
+ g_test_add_data_func ("/auth/missing-params/nonce", "Digest realm=\"auth-test\", qop=\"auth,auth-int\", opaque=\"5ccc069c403ebaf9f0171e9517f40e41\"", do_missing_params_test);
+ g_test_add_data_func ("/auth/missing-params/nonce-md5-sess", "Digest realm=\"auth-test\", qop=\"auth,auth-int\", opaque=\"5ccc069c403ebaf9f0171e9517f40e41\" algorithm=\"MD5-sess\"", do_missing_params_test);
+--
+2.34.1
+
@@ -40,6 +40,7 @@ SRC_URI = "${GNOME_MIRROR}/libsoup/${SHRT_VER}/libsoup-${PV}.tar.xz \
file://CVE-2025-32051-1.patch \
file://CVE-2025-32051-2.patch \
file://CVE-2025-32050.patch \
+ file://CVE-2025-46421.patch \
"
SRC_URI[sha256sum] = "291c67725f36ed90ea43efff25064b69c5a2d1981488477c05c481a3b4b0c5aa"