diff options
| author | zeripath <art27@cantab.net> | 2022-03-23 16:12:36 +0000 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-03-23 16:12:36 +0000 |
| commit | 0b1686b67afc7d1113d87f8621a71f709b22320f (patch) | |
| tree | 2052246b3da403c27604e92a04a2ebb8dcfeb0c7 | |
| parent | 81b5bef55a10c59e43987ad4df291b104c69d771 (diff) | |
| download | gitea-0b1686b67afc7d1113d87f8621a71f709b22320f.tar.gz gitea-0b1686b67afc7d1113d87f8621a71f709b22320f.zip | |
Prevent redirect to Host (2) (#19175)
Unhelpfully Locations starting with `/\` will be converted by the
browser to `//` because ... well I do not fully understand. Certainly
the RFCs and MDN do not indicate that this would be expected. Providing
"compatibility" with the (mis)behaviour of a certain proprietary OS is
my suspicion. However, we clearly have to protect against this.
Therefore we should reject redirection locations that match the regular
expression: `^/[\\\\/]+`
Reference #9678
Signed-off-by: Andrew Thornton <art27@cantab.net>
| -rw-r--r-- | modules/context/context.go | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/modules/context/context.go b/modules/context/context.go index 61f58eabb2..6cd503984f 100644 --- a/modules/context/context.go +++ b/modules/context/context.go @@ -181,6 +181,12 @@ func (ctx *Context) RedirectToFirst(location ...string) { continue } + // Unfortunately browsers consider a redirect Location with preceding "//" and "/\" as meaning redirect to "http(s)://REST_OF_PATH" + // Therefore we should ignore these redirect locations to prevent open redirects + if len(loc) > 1 && loc[0] == '/' && (loc[1] == '/' || loc[1] == '\\') { + continue + } + u, err := url.Parse(loc) if err != nil || ((u.Scheme != "" || u.Host != "") && !strings.HasPrefix(strings.ToLower(loc), strings.ToLower(setting.AppURL))) { continue |