289a6cc · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

add check for //.* to prevent open redirect during oauth

commit289a6ccf463a425c7606178c510fc5eeb9c8b050 authorColin Arnott <arnottcr@gmail.com> dateMon 27 Mar 2017, 21:11 (10 years ago) parent712739f

2 files changed+2−2

unifiedsplit

oauthproxy.go+1−1

@@ -490,7 +490,7 @@ func (p *OAuthProxy) OAuthCallback(rw http.ResponseWriter, req *http.Request) {

490490 }

491491

492492 redirect := req.Form.Get("state")

493− if !strings.HasPrefix(redirect, "/") {

493+ if !strings.HasPrefix(redirect, "/") || strings.HasPrefix(redirect, "//") {

494494 redirect = "/"

495495 }

496496

providers/provider_default.go+1−1

@@ -88,7 +88,7 @@ func (p *ProviderData) GetLoginURL(redirectURI, finalRedirect string) string {

8888 params.Add("scope", p.Scope)

8989 params.Set("client_id", p.ClientID)

9090 params.Set("response_type", "code")

91− if strings.HasPrefix(finalRedirect, "/") {

91+ if strings.HasPrefix(finalRedirect, "/") && !strings.HasPrefix(finalRedirect,"//") {

9292 params.Add("state", finalRedirect)

9393 }

9494 a.RawQuery = params.Encode()