a316f8a · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

Merge pull request from GHSA-qqxw-m5fj-f7gv

check for /\ redirects

commita316f8a06f3c0ca2b5fc5fa18a91781b313607b2 authorDavid Stark <david@starkers.org> dateWed 29 Jan 2020, 12:37 (7 years ago) parentfc59a6d e21f098

2 files changed+2−2

unifiedsplit

CHANGELOG.md+1−1

@@ -17,7 +17,7 @@

1717- DigitalOcean provider support added

1818

1919## Important Notes

20−N/A

20+- (Security) Fix for open redirect vulnerability.. a bad actor using `/\` in redirect URIs can redirect a session to another domain

2121

2222## Breaking Changes

2323

oauthproxy.go+1−1

@@ -558,7 +558,7 @@ func validOptionalPort(port string) bool {

558558// IsValidRedirect checks whether the redirect URL is whitelisted

559559func (p *OAuthProxy) IsValidRedirect(redirect string) bool {

560560 switch {

561− case strings.HasPrefix(redirect, "/") && !strings.HasPrefix(redirect, "//"):

561+ case strings.HasPrefix(redirect, "/") && !strings.HasPrefix(redirect, "//") && !strings.HasPrefix(redirect, "/\\"):

562562 return true

563563 case strings.HasPrefix(redirect, "http://") || strings.HasPrefix(redirect, "https://"):

564564 redirectURL, err := url.Parse(redirect)