From: Lauris BH <lauris@nix.lv>
Date: Thu, 8 Jun 2023 17:03:15 +0000 (+0300)
Subject: Fix open redirect check for more cases (#25143) (#25155)
X-Git-Tag: v1.19.4~9
X-Git-Url: https://source.dussan.org/?a=commitdiff_plain;h=a9030052a7b92bdfa1a6be0cdb540050a16ba31e;p=gitea.git

Fix open redirect check for more cases (#25143) (#25155)

Backport https://github.com/go-gitea/gitea/pull/25143

If redirect_to parameter has set value starting with \\example.com
redirect will be created with header Location: /\\example.com that will
redirect to example.com domain.
---

diff --git a/modules/context/context.go b/modules/context/context.go
index eecad20606..59bf897928 100644
--- a/modules/context/context.go
+++ b/modules/context/context.go
@@ -197,9 +197,9 @@ func (ctx *Context) RedirectToFirst(location ...string) {
 			continue
 		}
 
-		// Unfortunately browsers consider a redirect Location with preceding "//" and "/\" as meaning redirect to "http(s)://REST_OF_PATH"
+		// Unfortunately browsers consider a redirect Location with preceding "//", "\\" and "/\" as meaning redirect to "http(s)://REST_OF_PATH"
 		// Therefore we should ignore these redirect locations to prevent open redirects
-		if len(loc) > 1 && loc[0] == '/' && (loc[1] == '/' || loc[1] == '\\') {
+		if len(loc) > 1 && (loc[0] == '/' || loc[0] == '\\') && (loc[1] == '/' || loc[1] == '\\') {
 			continue
 		}