bfb2250 · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

allow redirects to whitelisted hosts with ports

commitbfb22506ff5f2c3db37eb7db7aa4089ac7ebbd7b authorKamal Nasser <hello@kamal.io> dateFri 11 Oct 2019, 15:39 (7 years ago) parent62bf233

2 files changed+7−1

unifiedsplit

oauthproxy.go+1−1

@@ -505,7 +505,7 @@ func (p *OAuthProxy) IsValidRedirect(redirect string) bool {

505505 return false

506506 }

507507 for _, domain := range p.whitelistDomains {

508− if (redirectURL.Host == domain) || (strings.HasPrefix(domain, ".") && strings.HasSuffix(redirectURL.Host, domain)) {

508+ if (redirectURL.Hostname() == domain) || (strings.HasPrefix(domain, ".") && strings.HasSuffix(redirectURL.Hostname(), domain)) {

509509 return true

510510 }

511511 }

oauthproxy_test.go+6

@@ -225,6 +225,12 @@ func TestIsValidRedirect(t *testing.T) {

225225

226226 invalidHTTPS2 := proxy.IsValidRedirect("https://evil.corp/redirect?rd=foo.bar")

227227 assert.Equal(t, false, invalidHTTPS2)

228+

229+ validPort := proxy.IsValidRedirect("http://foo.bar:3838/redirect")

230+ assert.Equal(t, true, validPort)

231+

232+ validPortSubdomain := proxy.IsValidRedirect("http://baz.bar.foo:3838/redirect")

233+ assert.Equal(t, true, validPortSubdomain)

228234}

229235

230236type TestProvider struct {