What
Installing a plugin from an archive URL now re-applies the URL policy at each redirect, and refuses the install if any hop fails it. Headers inherited from the marketplace are stripped when a redirect crosses to a different origin, and a sha256 that does not match aborts the install.
Details
- Marketplace catalog redirects must stay on the same origin, or be https to a host that is neither loopback nor a cloud metadata address.
- An archive that does not actually contain the component paths its marketplace entry declares is rejected, with advice on repackaging.
Evidence
plugin archive redirect policy rejected
Strings lifted out of the shipped bundle, so the claim above can be checked against them.