git.iko.soy/typeable/oauth2-proxy
on master help sign in
Merge pull request from GHSA-5m6c-jp6f-2vcv

* Add more Open Redirect test cases * Add whitelisted domain to test * Add more test cases * Improve invalid redirect regex

commitee5662e0f5001d76ec76562bb605abbd07c266a2 authorJoel Speed <Joel.speed@hotmail.co.uk> dateSat 27 Jun 2020, 12:07 (6 years ago) parent1b6c54c
3 files changed+641−1
compare with master
unifiedsplit
oauthproxy.go+1−1 oauthproxy_test.go+81 test/openredirects.txt+559
oauthproxy.go+1−1
@@ -63,7 +63,7 @@ var (
6363
6464 // Used to check final redirects are not susceptible to open redirects.
6565 // Matches //, /\ and both of these with whitespace in between (eg / / or / \).
66− invalidRedirectRegex = regexp.MustCompile(`^/(\s|\v)?(/|\\)`)
66+ invalidRedirectRegex = regexp.MustCompile(`[/\\](?:[\s\v]*|\.{1,2})[/\\]`)
6767)
6868
6969// OAuthProxy is the main authentication proxy
oauthproxy_test.go+81
@@ -1,6 +1,7 @@
11package main
22
33import (
4+ "bufio"
45 "context"
56 "crypto"
67 "encoding/base64"
@@ -11,6 +12,7 @@ import (
1112 "net/http"
1213 "net/http/httptest"
1314 "net/url"
15+ "os"
1416 "regexp"
1517 "strings"
1618 "testing"
@@ -386,6 +388,41 @@ func TestIsValidRedirect(t *testing.T) {
386388 Redirect: "/\r\\evil.com",
387389 ExpectedResult: false,
388390 },
391+ {
392+ Desc: "openRedirectTripleTab",
393+ Redirect: "/\t\t/\t/evil.com",
394+ ExpectedResult: false,
395+ },
396+ {
397+ Desc: "openRedirectTripleTab2",
398+ Redirect: "/\t\t\\\t/evil.com",
399+ ExpectedResult: false,
400+ },
401+ {
402+ Desc: "openRedirectQuadTab1",
403+ Redirect: "/\t\t/\t\t\\evil.com",
404+ ExpectedResult: false,
405+ },
406+ {
407+ Desc: "openRedirectQuadTab2",
408+ Redirect: "/\t\t\\\t\t/evil.com",
409+ ExpectedResult: false,
410+ },
411+ {
412+ Desc: "openRedirectPeriod1",
413+ Redirect: "/./\\evil.com",
414+ ExpectedResult: false,
415+ },
416+ {
417+ Desc: "openRedirectPeriod2",
418+ Redirect: "/./../../\\evil.com",
419+ ExpectedResult: false,
420+ },
421+ {
422+ Desc: "openRedirectDoubleTab",
423+ Redirect: "/\t/\t\\evil.com",
424+ ExpectedResult: false,
425+ },
389426 }
390427
391428 for _, tc := range testCases {
@@ -399,6 +436,50 @@ func TestIsValidRedirect(t *testing.T) {
399436 }
400437}
401438
439+func TestOpenRedirects(t *testing.T) {
440+ opts := NewOptions()
441+ opts.ClientID = "skdlfj"
442+ opts.ClientSecret = "fgkdsgj"
443+ opts.Cookie.Secret = "ljgiogbj"
444+ // Should match domains that are exactly foo.bar and any subdomain of bar.foo
445+ opts.WhitelistDomains = []string{
446+ "foo.bar",
447+ ".bar.foo",
448+ "port.bar:8080",
449+ ".sub.port.bar:8080",
450+ "anyport.bar:*",
451+ ".sub.anyport.bar:*",
452+ "www.whitelisteddomain.tld",
453+ }
454+ opts.Validate()
455+
456+ proxy := NewOAuthProxy(opts, func(string) bool { return true })
457+
458+ file, err := os.Open("./test/openredirects.txt")
459+ if err != nil {
460+ t.Fatal(err)
461+ }
462+ defer file.Close()
463+
464+ scanner := bufio.NewScanner(file)
465+ for scanner.Scan() {
466+ rd := scanner.Text()
467+ t.Run(rd, func(t *testing.T) {
468+ rdUnescaped, err := url.QueryUnescape(rd)
469+ if err != nil {
470+ t.Fatal(err)
471+ }
472+ if proxy.IsValidRedirect(rdUnescaped) {
473+ t.Errorf("Expected %q to not be valid (unescaped: %q)", rd, rdUnescaped)
474+ }
475+ })
476+ }
477+
478+ if err := scanner.Err(); err != nil {
479+ t.Fatal(err)
480+ }
481+}
482+
402483type TestProvider struct {
403484 *providers.ProviderData
404485 EmailAddress string
test/openredirects.txtnew file+559
@@ -0,0 +1,559 @@
1+
2+";alert(0);//
3+%19Jav%09asc%09ript:https%20://www.whitelisteddomain.tld/%250Aconfirm%25281%2529
4+%68%74%74%70%3a%2f%2f%67%6f%6f%67%6c%65%2e%63%6f%6d
5+.localdomain.pw
6+/%09/example.com
7+/%09/example.com@google.com
8+/%09/google.com
9+/%09/javascript:alert(1)
10+/%09/javascript:alert(1);
11+/%09/localdomain.pw
12+/%09/www.whitelisteddomain.tld@google.com
13+/%09/www.whitelisteddomain.tld@localdomain.pw
14+/%2f%2f%2fbing.com%2f%3fwww.omise.co
15+/%2f%2fexample.com
16+/%2f%2fgoogle.com
17+/%2f%2flocaldomain.pw
18+/%2f%5c%2f%67%6f%6f%67%6c%65%2e%63%6f%6d/
19+/%5cexample.com
20+/%5cexample.com@google.com
21+/%5cgoogle.com
22+/%5cjavascript:alert(1)
23+/%5cjavascript:alert(1);
24+/%5clocaldomain.pw
25+/%5cwww.whitelisteddomain.tld@google.com
26+/%5cwww.whitelisteddomain.tld@localdomain.pw
27+/%68%74%74%70%3a%2f%2f%67%6f%6f%67%6c%65%2e%63%6f%6d
28+//%09/example.com
29+//%09/example.com@google.com
30+//%09/google.com
31+//%09/localdomain.pw
32+//%09/www.whitelisteddomain.tld@google.com
33+//%09/www.whitelisteddomain.tld@localdomain.pw
34+//%2fxgoogle.com
35+//%5cexample.com
36+//%5cexample.com@google.com
37+//%5cgoogle.com
38+//%5cjavascript:alert(1)
39+//%5cjavascript:alert(1);
40+//%5clocaldomain.pw
41+//%5cwww.whitelisteddomain.tld@google.com
42+//%5cwww.whitelisteddomain.tld@localdomain.pw
43+///%09/example.com
44+///%09/example.com@google.com
45+///%09/google.com
46+///%09/localdomain.pw
47+///%09/www.whitelisteddomain.tld@google.com
48+///%09/www.whitelisteddomain.tld@localdomain.pw
49+///%5cexample.com
50+///%5cexample.com@google.com
51+///%5cgoogle.com
52+///%5clocaldomain.pw
53+///%5cwww.whitelisteddomain.tld@google.com
54+///%5cwww.whitelisteddomain.tld@localdomain.pw
55+////%09/example.com
56+////%09/example.com@google.com
57+////%09/google.com
58+////%09/localdomain.pw
59+////%09/www.whitelisteddomain.tld@google.com
60+////%09/www.whitelisteddomain.tld@localdomain.pw
61+////%5cexample.com
62+////%5cexample.com@google.com
63+////%5cgoogle.com
64+////%5clocaldomain.pw
65+////%5cwww.whitelisteddomain.tld@google.com
66+////%5cwww.whitelisteddomain.tld@localdomain.pw
67+/////example.com
68+/////example.com/
69+/////google.com/
70+/////localdomain.pw
71+/////localdomain.pw/
72+////\;@example.com
73+////example.com/
74+////example.com/%2e%2e
75+////example.com/%2e%2e%2f
76+////example.com/%2f%2e%2e
77+////example.com/%2f..
78+////example.com//
79+////example.com@google.com/
80+////example.com@google.com/%2e%2e
81+////example.com@google.com/%2e%2e%2f
82+////example.com@google.com/%2f%2e%2e
83+////example.com@google.com/%2f..
84+////example.com@google.com//
85+////google.com/
86+////google.com/%2e%2e
87+////google.com/%2e%2e%2f
88+////google.com/%2f%2e%2e
89+////google.com/%2f..
90+////google.com//
91+////localdomain.pw/
92+////localdomain.pw/%2e%2e
93+////localdomain.pw/%2e%2e%2f
94+////localdomain.pw/%2f%2e%2e
95+////localdomain.pw/%2f..
96+////localdomain.pw//
97+////www.google.com/%2e%2e
98+////www.google.com/%2e%2e%2f
99+////www.google.com/%2f%2e%2e
100+////www.whitelisteddomain.tld@google.com/
101+////www.whitelisteddomain.tld@google.com/%2f..
102+////www.whitelisteddomain.tld@google.com//
103+////www.whitelisteddomain.tld@localdomain.pw/
104+////www.whitelisteddomain.tld@localdomain.pw/%2e%2e
105+////www.whitelisteddomain.tld@localdomain.pw/%2e%2e%2f
106+////www.whitelisteddomain.tld@localdomain.pw/%2f%2e%2e
107+////www.whitelisteddomain.tld@localdomain.pw/%2f..
108+////www.whitelisteddomain.tld@localdomain.pw//
109+////www.whitelisteddomain.tld@www.google.com/%2e%2e
110+////www.whitelisteddomain.tld@www.google.com/%2e%2e%2f
111+////www.whitelisteddomain.tld@www.google.com/%2f%2e%2e
112+///\;@example.com
113+///\;@google.com
114+///\;@localdomain.pw
115+///example.com
116+///example.com/
117+///example.com/%2e%2e
118+///example.com/%2e%2e%2f
119+///example.com/%2f%2e%2e
120+///example.com/%2f..
121+///example.com//
122+///example.com@google.com/
123+///example.com@google.com/%2e%2e
124+///example.com@google.com/%2e%2e%2f
125+///example.com@google.com/%2f%2e%2e
126+///example.com@google.com/%2f..
127+///example.com@google.com//
128+///google.com
129+///google.com/
130+///google.com/%2e%2e
131+///google.com/%2e%2e%2f
132+///google.com/%2f%2e%2e
133+///google.com/%2f..
134+///google.com//
135+///localdomain.pw
136+///localdomain.pw/
137+///localdomain.pw/%2e%2e
138+///localdomain.pw/%2e%2e%2f
139+///localdomain.pw/%2f%2e%2e
140+///localdomain.pw/%2f..
141+///localdomain.pw//
142+///www.google.com/%2e%2e
143+///www.google.com/%2e%2e%2f
144+///www.google.com/%2f%2e%2e
145+///www.whitelisteddomain.tld@google.com/
146+///www.whitelisteddomain.tld@google.com/%2f..
147+///www.whitelisteddomain.tld@google.com//
148+///www.whitelisteddomain.tld@localdomain.pw/
149+///www.whitelisteddomain.tld@localdomain.pw/%2e%2e
150+///www.whitelisteddomain.tld@localdomain.pw/%2e%2e%2f
151+///www.whitelisteddomain.tld@localdomain.pw/%2f%2e%2e
152+///www.whitelisteddomain.tld@localdomain.pw/%2f..
153+///www.whitelisteddomain.tld@localdomain.pw//
154+///www.whitelisteddomain.tld@www.google.com/%2e%2e
155+///www.whitelisteddomain.tld@www.google.com/%2e%2e%2f
156+///www.whitelisteddomain.tld@www.google.com/%2f%2e%2e
157+//3H6k7lIAiqjfNeN@example.com+@google.com/
158+//3H6k7lIAiqjfNeN@example.com@google.com/
159+//3H6k7lIAiqjfNeN@www.whitelisteddomain.tld+@localdomain.pw/
160+//3H6k7lIAiqjfNeN@www.whitelisteddomain.tld@localdomain.pw/
161+//;@google.com
162+//;@localdomain.pw
163+//XY>.7d8T\205pZM@example.com+@google.com/
164+//XY>.7d8T\205pZM@example.com@google.com/
165+//XY>.7d8T\205pZM@www.whitelisteddomain.tld+@localdomain.pw/
166+//XY>.7d8T\205pZM@www.whitelisteddomain.tld@localdomain.pw/
167+//example.com
168+//example.com+&@google.com#+@example.com/
169+//example.com/
170+//example.com/%2e%2e
171+//example.com/%2e%2e%2f
172+//example.com/%2f%2e%2e
173+//example.com/%2f..
174+//example.com//
175+//example.com@google.com/
176+//example.com@google.com/%2e%2e%2f
177+//example.com@google.com/%2f%2e%2e
178+//example.com@google.com/%2f..
179+//example.com@google.com//
180+//example.com@https:///google.com/%2e%2e
181+//google%00.com
182+//google%E3%80%82com
183+//google.com
184+//google.com/
185+//google.com/%2e%2e%2f
186+//google.com/%2f%2e%2e
187+//google.com/%2f..
188+//google.com//
189+//google.com:80#@example.com/
190+//google.com:80?@example.com/
191+//google.com\@example.com
192+//google.com\@www.whitelisteddomain.tld
193+//google.com\texample.com/
194+//https:///example.com/%2e%2e
195+//https:///google.com/%2e%2e
196+//https:///localdomain.pw/%2e%2e
197+//https:///www.google.com/%2e%2e
198+//https://example.com/%2e%2e%2f
199+//https://example.com//
200+//https://example.com@google.com/%2e%2e%2f
201+//https://example.com@google.com//
202+//https://google.com/%2e%2e%2f
203+//https://google.com//
204+//https://localdomain.pw/%2e%2e%2f
205+//https://localdomain.pw//
206+//https://www.google.com/%2e%2e%2f
207+//https://www.whitelisteddomain.tld@google.com//
208+//https://www.whitelisteddomain.tld@localdomain.pw/%2e%2e%2f
209+//https://www.whitelisteddomain.tld@localdomain.pw//
210+//https://www.whitelisteddomain.tld@www.google.com/%2e%2e%2f
211+//javascript:alert(1)
212+//javascript:alert(1);
213+//localdomain%00.pw
214+//localdomain%E3%80%82pw
215+//localdomain.pw
216+//localdomain.pw/
217+//localdomain.pw/%2e%2e%2f
218+//localdomain.pw/%2f%2e%2e
219+//localdomain.pw/%2f..
220+//localdomain.pw//
221+//localdomain.pw:80#@www.whitelisteddomain.tld/
222+//localdomain.pw:80?@www.whitelisteddomain.tld/
223+//localdomain.pw\@www.whitelisteddomain.tld
224+//localdomain.pw\twww.whitelisteddomain.tld/
225+//www.google.com/%2e%2e%2f
226+//www.google.com/%2f%2e%2e
227+//www.whitelisteddomain.tld+&@localdomain.pw#+@www.whitelisteddomain.tld/
228+//www.whitelisteddomain.tld@google.com/
229+//www.whitelisteddomain.tld@google.com/%2f..
230+//www.whitelisteddomain.tld@google.com//
231+//www.whitelisteddomain.tld@https:///localdomain.pw/%2e%2e
232+//www.whitelisteddomain.tld@https:///www.google.com/%2e%2e
233+//www.whitelisteddomain.tld@localdomain.pw/
234+//www.whitelisteddomain.tld@localdomain.pw/%2e%2e%2f
235+//www.whitelisteddomain.tld@localdomain.pw/%2f%2e%2e
236+//www.whitelisteddomain.tld@localdomain.pw/%2f..
237+//www.whitelisteddomain.tld@localdomain.pw//
238+//www.whitelisteddomain.tld@www.google.com/%2e%2e%2f
239+//www.whitelisteddomain.tld@www.google.com/%2f%2e%2e
240+/<>//example.com
241+/?url=//example.com&next=//example.com&redirect=//example.com&redir=//example.com&rurl=//example.com&redirect_uri=//example.com
242+/?url=/\/example.com&next=/\/example.com&redirect=/\/example.com&redirect_uri=/\/example.com
243+/?url=Https://example.com&next=Https://example.com&redirect=Https://example.com&redir=Https://example.com&rurl=Https://example.com&redirect_uri=Https://example.com
244+/ReceiveAutoRedirect/false?desiredLocationUrl=http://xssposed.org
245+/\/\/example.com/
246+/\/example.com/
247+/\/google.com/
248+/\/localdomain.pw/
249+/example.com/%2f%2e%2e
250+/google.com/%2f%2e%2e
251+/http://%67%6f%6f%67%6c%65%2e%63%6f%6d
252+/http://example.com
253+/http://google.com
254+/http://localdomain.pw
255+/https:/%5cexample.com/
256+/https:/%5cgoogle.com/
257+/https:/%5clocaldomain.pw/
258+/https://%09/example.com
259+/https://%5cexample.com
260+/https://%5cexample.com@google.com
261+/https://%5cgoogle.com
262+/https://%5clocaldomain.pw
263+/https://%5cwww.whitelisteddomain.tld@google.com
264+/https://%5cwww.whitelisteddomain.tld@localdomain.pw
265+/https:///example.com/%2e%2e
266+/https:///example.com/%2f%2e%2e
267+/https:///example.com@google.com/%2f%2e%2e
268+/https:///google.com/%2f%2e%2e
269+/https:///localdomain.pw/%2f%2e%2e
270+/https:///www.google.com/%2f%2e%2e
271+/https:///www.whitelisteddomain.tld@localdomain.pw/%2f%2e%2e
272+/https:///www.whitelisteddomain.tld@www.google.com/%2f%2e%2e
273+/https://example.com
274+/https://example.com/
275+/https://example.com/%2e%2e
276+/https://example.com/%2e%2e%2f
277+/https://example.com/%2f%2e%2e
278+/https://example.com/%2f..
279+/https://example.com//
280+/https://example.com@google.com/
281+/https://example.com@google.com/%2e%2e
282+/https://example.com@google.com/%2f%2e%2e
283+/https://example.com@google.com/%2f..
284+/https://google.com/
285+/https://google.com/%2e%2e
286+/https://google.com/%2f%2e%2e
287+/https://google.com/%2f..
288+/https://localdomain.pw/
289+/https://localdomain.pw/%2e%2e
290+/https://localdomain.pw/%2f%2e%2e
291+/https://localdomain.pw/%2f..
292+/https://www.google.com/%2e%2e
293+/https://www.google.com/%2f%2e%2e
294+/https://www.whitelisteddomain.tld@google.com/
295+/https://www.whitelisteddomain.tld@google.com/%2f..
296+/https://www.whitelisteddomain.tld@localdomain.pw/
297+/https://www.whitelisteddomain.tld@localdomain.pw/%2e%2e
298+/https://www.whitelisteddomain.tld@localdomain.pw/%2f%2e%2e
299+/https://www.whitelisteddomain.tld@localdomain.pw/%2f..
300+/https://www.whitelisteddomain.tld@www.google.com/%2e%2e
301+/https://www.whitelisteddomain.tld@www.google.com/%2f%2e%2e
302+/localdomain.pw/%2f%2e%2e
303+/redirect?url=//example.com&next=//example.com&redirect=//example.com&redir=//example.com&rurl=//example.com&redirect_uri=//example.com
304+/redirect?url=/\/example.com&next=/\/example.com&redirect=/\/example.com&redir=/\/example.com&rurl=/\/example.com&redirect_uri=/\/example.com
305+/redirect?url=Https://example.com&next=Https://example.com&redirect=Https://example.com&redir=Https://example.com&rurl=Https://example.com&redirect_uri=Https://example.com
306+/x:1/:///%01javascript:alert(document.cookie)/
307+<>//google.com
308+<>//localdomain.pw
309+<>javascript:alert(1);
310+@google.com
311+@localdomain.pw
312+Javas%26%2399;ript:alert(1)
313+\/\/google.com/
314+\/\/localdomain.pw/
315+\152\141\166\141\163\143\162\151\160\164\072alert(1)
316+\j\av\a\s\cr\i\pt\:\a\l\ert\(1\)
317+\u006A\u0061\u0076\u0061\u0073\u0063\u0072\u0069\u0070\u0074\u003aalert(1)
318+\x6A\x61\x76\x61\x73\x63\x72\x69\x70\x74\x3aalert(1)
319+data:text/html;base64,PHNjcmlwdD5hbGVydCgiWFNTIik8L3NjcmlwdD4=
320+data:www.whitelisteddomain.tld;text/html;charset=UTF-8,<html><script>document.write(document.domain);</script><iframe/src=xxxxx>aaaa</iframe></html>
321+http://%67%6f%6f%67%6c%65%2e%63%6f%6d
322+http://.localdomain.pw
323+http://00330.00072.0000326.00000316
324+http://00330.0x3a.54990
325+http://00330.3856078
326+http://0330.072.0326.0316
327+http://0xd8.072.54990
328+http://0xd8.0x3a.0xd6.0xce
329+http://0xd8.3856078
330+http://0xd83ad6ce
331+http://3627734734
332+http://3H6k7lIAiqjfNeN@00330.00072.0000326.00000316
333+http://3H6k7lIAiqjfNeN@00330.0x3a.54990
334+http://3H6k7lIAiqjfNeN@00330.3856078
335+http://3H6k7lIAiqjfNeN@0330.072.0326.0316
336+http://3H6k7lIAiqjfNeN@0xd8.072.54990
337+http://3H6k7lIAiqjfNeN@0xd8.0x3a.0xd6.0xce
338+http://3H6k7lIAiqjfNeN@0xd8.3856078
339+http://3H6k7lIAiqjfNeN@0xd83ad6ce
340+http://3H6k7lIAiqjfNeN@3627734734
341+http://3H6k7lIAiqjfNeN@472.314.470.462
342+http://3H6k7lIAiqjfNeN@[::216.58.214.206]
343+http://3H6k7lIAiqjfNeN@[::ffff:216.58.214.206]
344+http://3H6k7lIAiqjfNeN@example.com+@google.com/
345+http://3H6k7lIAiqjfNeN@example.com@google.com/
346+http://3H6k7lIAiqjfNeN@www.whitelisteddomain.tld+@localdomain.pw/
347+http://3H6k7lIAiqjfNeN@www.whitelisteddomain.tld@localdomain.pw/
348+http://472.314.470.462
349+http://;@google.com
350+http://;@localdomain.pw
351+http://XY>.7d8T\205pZM@00330.00072.0000326.00000316
352+http://XY>.7d8T\205pZM@00330.0x3a.54990
353+http://XY>.7d8T\205pZM@00330.3856078
354+http://XY>.7d8T\205pZM@0330.072.0326.0316
355+http://XY>.7d8T\205pZM@0xd8.072.54990
356+http://XY>.7d8T\205pZM@0xd8.0x3a.0xd6.0xce
357+http://XY>.7d8T\205pZM@0xd8.3856078
358+http://XY>.7d8T\205pZM@0xd83ad6ce
359+http://XY>.7d8T\205pZM@3627734734
360+http://XY>.7d8T\205pZM@472.314.470.462
361+http://XY>.7d8T\205pZM@[::216.58.214.206]
362+http://XY>.7d8T\205pZM@[::ffff:216.58.214.206]
363+http://XY>.7d8T\205pZM@example.com+@google.com/
364+http://XY>.7d8T\205pZM@example.com@google.com/
365+http://XY>.7d8T\205pZM@www.whitelisteddomain.tld+@localdomain.pw/
366+http://XY>.7d8T\205pZM@www.whitelisteddomain.tld@localdomain.pw/
367+http://[::216.58.214.206]
368+http://[::ffff:216.58.214.206]
369+http://example.com%2egoogle.com/
370+http://example.com+&@google.com#+@example.com/
371+http://example.com:80%40google.com/
372+http://example.com@00330.00072.0000326.00000316
373+http://example.com@00330.0x3a.54990
374+http://example.com@00330.3856078
375+http://example.com@0330.072.0326.0316
376+http://example.com@0xd8.072.54990
377+http://example.com@0xd8.0x3a.0xd6.0xce
378+http://example.com@0xd8.3856078
379+http://example.com@0xd83ad6ce
380+http://example.com@3627734734
381+http://example.com@472.314.470.462
382+http://example.com@[::216.58.214.206]
383+http://example.com@[::ffff:216.58.214.206]
384+http://google.com%23.example.com/
385+http://google.com%2f%2f.example.com/
386+http://google.com%3F.example.com/
387+http://google.com%5c%5c.example.com/
388+http://google.com:80#@example.com/
389+http://google.com:80#@www.whitelisteddomain.tld/
390+http://google.com:80?@example.com/
391+http://google.com:80?@www.whitelisteddomain.tld/
392+http://google.com\texample.com/
393+http://localdomain.pw%23.www.whitelisteddomain.tld/
394+http://localdomain.pw%2f%2f.www.whitelisteddomain.tld/
395+http://localdomain.pw%3F.www.whitelisteddomain.tld/
396+http://localdomain.pw%5c%5c.www.whitelisteddomain.tld/
397+http://localdomain.pw:80#@www.whitelisteddomain.tld/
398+http://localdomain.pw:80?@www.whitelisteddomain.tld/
399+http://localdomain.pw\twww.whitelisteddomain.tld/
400+http://www.localdomain.pw\.www.whitelisteddomain.tld
401+http://www.whitelisteddomain.tld%2elocaldomain.pw/
402+http://www.whitelisteddomain.tld+&@localdomain.pw#+@www.whitelisteddomain.tld/
403+http://www.whitelisteddomain.tld:80%40localdomain.pw/
404+http://www.whitelisteddomain.tld@00330.00072.0000326.00000316
405+http://www.whitelisteddomain.tld@00330.0x3a.54990
406+http://www.whitelisteddomain.tld@00330.3856078
407+http://www.whitelisteddomain.tld@0330.072.0326.0316
408+http://www.whitelisteddomain.tld@0xd8.072.54990
409+http://www.whitelisteddomain.tld@0xd8.0x3a.0xd6.0xce
410+http://www.whitelisteddomain.tld@0xd8.3856078
411+http://www.whitelisteddomain.tld@0xd83ad6ce
412+http://www.whitelisteddomain.tld@3627734734
413+http://www.whitelisteddomain.tld@472.314.470.462
414+http://www.whitelisteddomain.tld@[::216.58.214.206]
415+http://www.whitelisteddomain.tld@[::ffff:216.58.214.206]
416+http:00330.00072.0000326.00000316
417+http:00330.0x3a.54990
418+http:00330.3856078
419+http:0330.072.0326.0316
420+http:0xd8.072.54990
421+http:0xd8.0x3a.0xd6.0xce
422+http:0xd8.3856078
423+http:0xd83ad6ce
424+http:3627734734
425+http:3H6k7lIAiqjfNeN@00330.00072.0000326.00000316
426+http:3H6k7lIAiqjfNeN@00330.0x3a.54990
427+http:3H6k7lIAiqjfNeN@00330.3856078
428+http:3H6k7lIAiqjfNeN@0330.072.0326.0316
429+http:3H6k7lIAiqjfNeN@0xd8.072.54990
430+http:3H6k7lIAiqjfNeN@0xd8.0x3a.0xd6.0xce
431+http:3H6k7lIAiqjfNeN@0xd8.3856078
432+http:3H6k7lIAiqjfNeN@0xd83ad6ce
433+http:3H6k7lIAiqjfNeN@3627734734
434+http:3H6k7lIAiqjfNeN@472.314.470.462
435+http:3H6k7lIAiqjfNeN@[::216.58.214.206]
436+http:3H6k7lIAiqjfNeN@[::ffff:216.58.214.206]
437+http:472.314.470.462
438+http:XY>.7d8T\205pZM@00330.00072.0000326.00000316
439+http:XY>.7d8T\205pZM@00330.0x3a.54990
440+http:XY>.7d8T\205pZM@00330.3856078
441+http:XY>.7d8T\205pZM@0330.072.0326.0316
442+http:XY>.7d8T\205pZM@0xd8.072.54990
443+http:XY>.7d8T\205pZM@0xd8.0x3a.0xd6.0xce
444+http:XY>.7d8T\205pZM@0xd8.3856078
445+http:XY>.7d8T\205pZM@0xd83ad6ce
446+http:XY>.7d8T\205pZM@3627734734
447+http:XY>.7d8T\205pZM@472.314.470.462
448+http:XY>.7d8T\205pZM@[::216.58.214.206]
449+http:XY>.7d8T\205pZM@[::ffff:216.58.214.206]
450+http:[::216.58.214.206]
451+http:[::ffff:216.58.214.206]
452+http:example.com@00330.00072.0000326.00000316
453+http:example.com@00330.0x3a.54990
454+http:example.com@00330.3856078
455+http:example.com@0330.072.0326.0316
456+http:example.com@0xd8.072.54990
457+http:example.com@0xd8.0x3a.0xd6.0xce
458+http:example.com@0xd8.3856078
459+http:example.com@0xd83ad6ce
460+http:example.com@3627734734
461+http:example.com@472.314.470.462
462+http:example.com@[::216.58.214.206]
463+http:example.com@[::ffff:216.58.214.206]
464+http:www.whitelisteddomain.tld@00330.00072.0000326.00000316
465+http:www.whitelisteddomain.tld@00330.0x3a.54990
466+http:www.whitelisteddomain.tld@00330.3856078
467+http:www.whitelisteddomain.tld@0330.072.0326.0316
468+http:www.whitelisteddomain.tld@0xd8.072.54990
469+http:www.whitelisteddomain.tld@0xd8.0x3a.0xd6.0xce
470+http:www.whitelisteddomain.tld@0xd8.3856078
471+http:www.whitelisteddomain.tld@0xd83ad6ce
472+http:www.whitelisteddomain.tld@3627734734
473+http:www.whitelisteddomain.tld@472.314.470.462
474+http:www.whitelisteddomain.tld@[::216.58.214.206]
475+http:www.whitelisteddomain.tld@[::ffff:216.58.214.206]
476+https://%09/example.com@google.com
477+https://%09/google.com
478+https://%09/localdomain.pw
479+https://%09/www.whitelisteddomain.tld@google.com
480+https://%09/www.whitelisteddomain.tld@localdomain.pw
481+https://%5cexample.com@google.com
482+https://%5cgoogle.com
483+https://%5clocaldomain.pw
484+https://%5cwww.whitelisteddomain.tld@google.com
485+https://%5cwww.whitelisteddomain.tld@localdomain.pw
486+https:///example.com@google.com/%2e%2e
487+https:///example.com@google.com/%2f%2e%2e
488+https:///google.com/%2e%2e
489+https:///google.com/%2f%2e%2e
490+https:///localdomain.pw/%2e%2e
491+https:///localdomain.pw/%2f%2e%2e
492+https:///www.google.com/%2e%2e
493+https:///www.google.com/%2f%2e%2e
494+https:///www.whitelisteddomain.tld@localdomain.pw/%2e%2e
495+https:///www.whitelisteddomain.tld@localdomain.pw/%2f%2e%2e
496+https:///www.whitelisteddomain.tld@www.google.com/%2e%2e
497+https:///www.whitelisteddomain.tld@www.google.com/%2f%2e%2e
498+https://:@google.com\@example.com
499+https://:@google.com\@www.whitelisteddomain.tld
500+https://:@localdomain.pw\@www.whitelisteddomain.tld
501+https://example.com/https://google.com/
502+https://example.com@google.com
503+https://example.com@google.com/
504+https://example.com@google.com/%2e%2e%2f
505+https://example.com@google.com/%2f%2e%2e
506+https://example.com@google.com/%2f..
507+https://example.com@google.com//
508+https://google.com
509+https://google.com/
510+https://google.com/%2e%2e%2f
511+https://google.com/%2f%2e%2e
512+https://google.com/%2f..
513+https://google.com//
514+https://localdomain.pw
515+https://localdomain.pw/
516+https://localdomain.pw/%2e%2e%2f
517+https://localdomain.pw/%2f%2e%2e
518+https://localdomain.pw/%2f..
519+https://localdomain.pw//
520+https://www.google.com/%2e%2e%2f
521+https://www.google.com/%2f%2e%2e
522+https://www.whitelisteddomain.tld@google.com
523+https://www.whitelisteddomain.tld@google.com/
524+https://www.whitelisteddomain.tld@google.com/%2f..
525+https://www.whitelisteddomain.tld@google.com//
526+https://www.whitelisteddomain.tld@localdomain.pw
527+https://www.whitelisteddomain.tld@localdomain.pw/
528+https://www.whitelisteddomain.tld@localdomain.pw/%2e%2e%2f
529+https://www.whitelisteddomain.tld@localdomain.pw/%2f%2e%2e
530+https://www.whitelisteddomain.tld@localdomain.pw/%2f..
531+https://www.whitelisteddomain.tld@localdomain.pw//
532+https://www.whitelisteddomain.tld@www.google.com/%2e%2e%2f
533+https://www.whitelisteddomain.tld@www.google.com/%2f%2e%2e
534+https:google.com
535+https:localdomain.pw
536+jaVAscript://www.whitelisteddomain.tld//%0d%0aalert(1);//
537+ja\nva\tscript\r:alert(1)
538+java%09script:alert(1)
539+java%0ascript:alert(1)
540+java%0d%0ascript%0d%0a:alert(0)
541+java%0dscript:alert(1)
542+javascripT://anything%0D%0A%0D%0Awindow.alert(document.cookie)
543+javascript://%0aalert(1)
544+javascript://example.com?%a0alert%281%29
545+javascript://https://example.com/?z=%0Aalert(1)
546+javascript://https://www.whitelisteddomain.tld/?z=%0Aalert(1)
547+javascript://www.whitelisteddomain.tld?%a0alert%281%29
548+javascript:alert(1)
549+javascript:alert(1);
550+〱google.com
551+〱localdomain.pw
552+〵google.com
553+〵localdomain.pw
554+ゝgoogle.com
555+ゝlocaldomain.pw
556+ーgoogle.com
557+ーlocaldomain.pw
558+ｰgoogle.com
559+ｰlocaldomain.pw