@@ -93,6 +93,44 @@ func TestRobotsTxt(t *testing.T) {
9393 assert.Equal(t, "User-agent: *\nDisallow: /", rw.Body.String())
9494}
9595
96+func TestIsValidRedirect(t *testing.T) {
97+ opts := NewOptions()
98+ opts.ClientID = "bazquux"
99+ opts.ClientSecret = "foobar"
100+ opts.CookieSecret = "xyzzyplugh"
101+ opts.WhitelistDomains = []string{"foo.bar"}
102+ opts.Validate()
103+
104+ proxy := NewOAuthProxy(opts, func(string) bool { return true })
105+
106+ noRD := proxy.IsValidRedirect("")
107+ assert.Equal(t, false, noRD)
108+
109+ singleSlash := proxy.IsValidRedirect("/redirect")
110+ assert.Equal(t, true, singleSlash)
111+
112+ doubleSlash := proxy.IsValidRedirect("//redirect")
113+ assert.Equal(t, false, doubleSlash)
114+
115+ validHTTP := proxy.IsValidRedirect("http://baz.foo.bar/redirect")
116+ assert.Equal(t, true, validHTTP)
117+
118+ validHTTPS := proxy.IsValidRedirect("https://baz.foo.bar/redirect")
119+ assert.Equal(t, true, validHTTPS)
120+
121+ invalidHTTP1 := proxy.IsValidRedirect("http://foo.bar.evil.corp/redirect")
122+ assert.Equal(t, false, invalidHTTP1)
123+
124+ invalidHTTPS1 := proxy.IsValidRedirect("https://foo.bar.evil.corp/redirect")
125+ assert.Equal(t, false, invalidHTTPS1)
126+
127+ invalidHTTP2 := proxy.IsValidRedirect("http://evil.corp/redirect?rd=foo.bar")
128+ assert.Equal(t, false, invalidHTTP2)
129+
130+ invalidHTTPS2 := proxy.IsValidRedirect("https://evil.corp/redirect?rd=foo.bar")
131+ assert.Equal(t, false, invalidHTTPS2)
132+}
133+
96134type TestProvider struct {
97135 *providers.ProviderData
98136 EmailAddress string