@@ -182,49 +182,158 @@ func TestIsValidRedirect(t *testing.T) {
182182 opts.ClientSecret = "fgkdsgj"
183183 opts.CookieSecret = "ljgiogbj"
184184 // Should match domains that are exactly foo.bar and any subdomain of bar.foo
185− opts.WhitelistDomains = []string{"foo.bar", ".bar.foo"}
185+ opts.WhitelistDomains = []string{
186+ "foo.bar",
187+ ".bar.foo",
188+ "port.bar:8080",
189+ ".sub.port.bar:8080",
190+ "anyport.bar:*",
191+ ".sub.anyport.bar:*",
192+ }
186193 opts.Validate()
187194
188195 proxy := NewOAuthProxy(opts, func(string) bool { return true })
189196
190− noRD := proxy.IsValidRedirect("")
191− assert.Equal(t, false, noRD)
192−
193− singleSlash := proxy.IsValidRedirect("/redirect")
194− assert.Equal(t, true, singleSlash)
195−
196− doubleSlash := proxy.IsValidRedirect("//redirect")
197− assert.Equal(t, false, doubleSlash)
198−
199− validHTTP := proxy.IsValidRedirect("http://foo.bar/redirect")
200− assert.Equal(t, true, validHTTP)
201−
202− validHTTPS := proxy.IsValidRedirect("https://foo.bar/redirect")
203− assert.Equal(t, true, validHTTPS)
204−
205− invalidHTTPSubdomain := proxy.IsValidRedirect("http://baz.foo.bar/redirect")
206− assert.Equal(t, false, invalidHTTPSubdomain)
207−
208− invalidHTTPSSubdomain := proxy.IsValidRedirect("https://baz.foo.bar/redirect")
209− assert.Equal(t, false, invalidHTTPSSubdomain)
210−
211− validHTTPSubdomain := proxy.IsValidRedirect("http://baz.bar.foo/redirect")
212− assert.Equal(t, true, validHTTPSubdomain)
213−
214− validHTTPSSubdomain := proxy.IsValidRedirect("https://baz.bar.foo/redirect")
215− assert.Equal(t, true, validHTTPSSubdomain)
216−
217− invalidHTTP1 := proxy.IsValidRedirect("http://foo.bar.evil.corp/redirect")
218− assert.Equal(t, false, invalidHTTP1)
219−
220− invalidHTTPS1 := proxy.IsValidRedirect("https://foo.bar.evil.corp/redirect")
221− assert.Equal(t, false, invalidHTTPS1)
197+ testCases := []struct {
198+ Desc, Redirect string
199+ ExpectedResult bool
200+ }{
201+ {
202+ Desc: "noRD",
203+ Redirect: "",
204+ ExpectedResult: false,
205+ },
206+ {
207+ Desc: "singleSlash",
208+ Redirect: "/redirect",
209+ ExpectedResult: true,
210+ },
211+ {
212+ Desc: "doubleSlash",
213+ Redirect: "//redirect",
214+ ExpectedResult: false,
215+ },
216+ {
217+ Desc: "validHTTP",
218+ Redirect: "http://foo.bar/redirect",
219+ ExpectedResult: true,
220+ },
221+ {
222+ Desc: "validHTTPS",
223+ Redirect: "https://foo.bar/redirect",
224+ ExpectedResult: true,
225+ },
226+ {
227+ Desc: "invalidHTTPSubdomain",
228+ Redirect: "http://baz.foo.bar/redirect",
229+ ExpectedResult: false,
230+ },
231+ {
232+ Desc: "invalidHTTPSSubdomain",
233+ Redirect: "https://baz.foo.bar/redirect",
234+ ExpectedResult: false,
235+ },
236+ {
237+ Desc: "validHTTPSubdomain",
238+ Redirect: "http://baz.bar.foo/redirect",
239+ ExpectedResult: true,
240+ },
241+ {
242+ Desc: "validHTTPSSubdomain",
243+ Redirect: "https://baz.bar.foo/redirect",
244+ ExpectedResult: true,
245+ },
246+ {
247+ Desc: "validHTTPDomain",
248+ Redirect: "http://bar.foo/redirect",
249+ ExpectedResult: true,
250+ },
251+ {
252+ Desc: "invalidHTTP1",
253+ Redirect: "http://foo.bar.evil.corp/redirect",
254+ ExpectedResult: false,
255+ },
256+ {
257+ Desc: "invalidHTTPS1",
258+ Redirect: "https://foo.bar.evil.corp/redirect",
259+ ExpectedResult: false,
260+ },
261+ {
262+ Desc: "invalidHTTP2",
263+ Redirect: "http://evil.corp/redirect?rd=foo.bar",
264+ ExpectedResult: false,
265+ },
266+ {
267+ Desc: "invalidHTTPS2",
268+ Redirect: "https://evil.corp/redirect?rd=foo.bar",
269+ ExpectedResult: false,
270+ },
271+ {
272+ Desc: "invalidPort",
273+ Redirect: "https://evil.corp:3838/redirect",
274+ ExpectedResult: false,
275+ },
276+ {
277+ Desc: "invalidEmptyPort",
278+ Redirect: "http://foo.bar:3838/redirect",
279+ ExpectedResult: false,
280+ },
281+ {
282+ Desc: "invalidEmptyPortSubdomain",
283+ Redirect: "http://baz.bar.foo:3838/redirect",
284+ ExpectedResult: false,
285+ },
286+ {
287+ Desc: "validSpecificPort",
288+ Redirect: "http://port.bar:8080/redirect",
289+ ExpectedResult: true,
290+ },
291+ {
292+ Desc: "invalidSpecificPort",
293+ Redirect: "http://port.bar:3838/redirect",
294+ ExpectedResult: false,
295+ },
296+ {
297+ Desc: "validSpecificPortSubdomain",
298+ Redirect: "http://foo.sub.port.bar:8080/redirect",
299+ ExpectedResult: true,
300+ },
301+ {
302+ Desc: "invalidSpecificPortSubdomain",
303+ Redirect: "http://foo.sub.port.bar:3838/redirect",
304+ ExpectedResult: false,
305+ },
306+ {
307+ Desc: "validAnyPort1",
308+ Redirect: "http://anyport.bar:8080/redirect",
309+ ExpectedResult: true,
310+ },
311+ {
312+ Desc: "validAnyPort2",
313+ Redirect: "http://anyport.bar:8081/redirect",
314+ ExpectedResult: true,
315+ },
316+ {
317+ Desc: "validAnyPortSubdomain1",
318+ Redirect: "http://a.sub.anyport.bar:8080/redirect",
319+ ExpectedResult: true,
320+ },
321+ {
322+ Desc: "validAnyPortSubdomain2",
323+ Redirect: "http://a.sub.anyport.bar:8081/redirect",
324+ ExpectedResult: true,
325+ },
326+ }
222327
223− invalidHTTP2 := proxy.IsValidRedirect("http://evil.corp/redirect?rd=foo.bar")
224− assert.Equal(t, false, invalidHTTP2)
328+ for _, tc := range testCases {
329+ t.Run(tc.Desc, func(t *testing.T) {
330+ result := proxy.IsValidRedirect(tc.Redirect)
225331
226− invalidHTTPS2 := proxy.IsValidRedirect("https://evil.corp/redirect?rd=foo.bar")
227− assert.Equal(t, false, invalidHTTPS2)
332+ if result != tc.ExpectedResult {
333+ t.Errorf("expected %t got %t", tc.ExpectedResult, result)
334+ }
335+ })
336+ }
228337}
229338
230339type TestProvider struct {