git.iko.soy/typeable/oauth2-proxy
on master help sign in
implicit/explicit redirect port matching
commitae4e9155d27a4079670b909484e50696455e6925 authorKamal Nasser <hello@kamal.io> dateSat 12 Oct 2019, 23:47 (7 years ago) parentbfb2250
2 files changed+38−7
compare with master
unifiedsplit
oauthproxy.go+18−2 oauthproxy_test.go+20−5
oauthproxy.go+18−2
@@ -504,11 +504,27 @@ func (p *OAuthProxy) IsValidRedirect(redirect string) bool {
504504 if err != nil {
505505 return false
506506 }
507+ redirectHostname := redirectURL.Hostname()
508+
507509 for _, domain := range p.whitelistDomains {
508− if (redirectURL.Hostname() == domain) || (strings.HasPrefix(domain, ".") && strings.HasSuffix(redirectURL.Hostname(), domain)) {
509− return true
510+ domainURL := url.URL{
511+ Host: strings.TrimLeft(domain, "."),
512+ }
513+ domainHostname := domainURL.Hostname()
514+ if domainHostname == "" {
515+ continue
516+ }
517+
518+ if (redirectHostname == domainHostname) || (strings.HasPrefix(domain, ".") && strings.HasSuffix(redirectHostname, domainHostname)) {
519+ // if the domain has a port, only allow that port
520+ // otherwise allow any port
521+ domainPort := domainURL.Port()
522+ if (domainPort == "") || (domainPort == redirectURL.Port()) {
523+ return true
524+ }
510525 }
511526 }
527+
512528 return false
513529 default:
514530 return false
oauthproxy_test.go+20−5
@@ -182,7 +182,7 @@ func TestIsValidRedirect(t *testing.T) {
182182 opts.ClientSecret = "fgkdsgj"
183183 opts.CookieSecret = "ljgiogbj"
184184 // Should match domains that are exactly foo.bar and any subdomain of bar.foo
185− opts.WhitelistDomains = []string{"foo.bar", ".bar.foo"}
185+ opts.WhitelistDomains = []string{"foo.bar", ".bar.foo", "port.bar:8080", ".sub.port.bar:8080"}
186186 opts.Validate()
187187
188188 proxy := NewOAuthProxy(opts, func(string) bool { return true })
@@ -226,11 +226,26 @@ func TestIsValidRedirect(t *testing.T) {
226226 invalidHTTPS2 := proxy.IsValidRedirect("https://evil.corp/redirect?rd=foo.bar")
227227 assert.Equal(t, false, invalidHTTPS2)
228228
229− validPort := proxy.IsValidRedirect("http://foo.bar:3838/redirect")
230− assert.Equal(t, true, validPort)
229+ invalidPort := proxy.IsValidRedirect("https://evil.corp:3838/redirect")
230+ assert.Equal(t, false, invalidPort)
231231
232− validPortSubdomain := proxy.IsValidRedirect("http://baz.bar.foo:3838/redirect")
233− assert.Equal(t, true, validPortSubdomain)
232+ validAnyPort := proxy.IsValidRedirect("http://foo.bar:3838/redirect")
233+ assert.Equal(t, true, validAnyPort)
234+
235+ validAnyPortSubdomain := proxy.IsValidRedirect("http://baz.bar.foo:3838/redirect")
236+ assert.Equal(t, true, validAnyPortSubdomain)
237+
238+ validSpecificPort := proxy.IsValidRedirect("http://port.bar:8080/redirect")
239+ assert.Equal(t, true, validSpecificPort)
240+
241+ invalidSpecificPort := proxy.IsValidRedirect("http://port.bar:3838/redirect")
242+ assert.Equal(t, false, invalidSpecificPort)
243+
244+ validSpecificPortSubdomain := proxy.IsValidRedirect("http://foo.sub.port.bar:8080/redirect")
245+ assert.Equal(t, true, validSpecificPortSubdomain)
246+
247+ invalidSpecificPortSubdomain := proxy.IsValidRedirect("http://foo.sub.port.bar:3838/redirect")
248+ assert.Equal(t, false, invalidSpecificPortSubdomain)
234249}
235250
236251type TestProvider struct {