86d0832 · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

Merge pull request #359 from jehiah/redirect_check_359

Improve redirect checks

commit86d083266b747825a05f639560141e542019cf26 authorJehiah Czebotar <jehiah@gmail.com> dateTue 28 Mar 2017, 21:34 (10 years ago) parent712739f 289a6cc

2 files changed+2−2

compare with master

unifiedsplit

oauthproxy.go+1−1 providers/provider_default.go+1−1

oauthproxy.go+1−1

@@ -490,7 +490,7 @@ func (p *OAuthProxy) OAuthCallback(rw http.ResponseWriter, req *http.Request) {

490490 }

491491

492492 redirect := req.Form.Get("state")

493− if !strings.HasPrefix(redirect, "/") {

493+ if !strings.HasPrefix(redirect, "/") || strings.HasPrefix(redirect, "//") {

494494 redirect = "/"

495495 }

496496

providers/provider_default.go+1−1

@@ -88,7 +88,7 @@ func (p *ProviderData) GetLoginURL(redirectURI, finalRedirect string) string {

8888 params.Add("scope", p.Scope)

8989 params.Set("client_id", p.ClientID)

9090 params.Set("response_type", "code")

91− if strings.HasPrefix(finalRedirect, "/") {

91+ if strings.HasPrefix(finalRedirect, "/") && !strings.HasPrefix(finalRedirect,"//") {

9292 params.Add("state", finalRedirect)

9393 }

9494 a.RawQuery = params.Encode()