diff options
| author | Lauris BH <lauris@nix.lv> | 2023-06-08 20:03:15 +0300 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-06-08 13:03:15 -0400 |
| commit | a9030052a7b92bdfa1a6be0cdb540050a16ba31e (patch) | |
| tree | 59f3064e69d86396f3d848b107e269600bc0c295 | |
| parent | ed78711e469865c378a295d00156e92b62f33105 (diff) | |
| download | gitea-a9030052a7b92bdfa1a6be0cdb540050a16ba31e.tar.gz gitea-a9030052a7b92bdfa1a6be0cdb540050a16ba31e.zip | |
Fix open redirect check for more cases (#25143) (#25155)
Backport https://github.com/go-gitea/gitea/pull/25143
If redirect_to parameter has set value starting with \\example.com
redirect will be created with header Location: /\\example.com that will
redirect to example.com domain.
| -rw-r--r-- | modules/context/context.go | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/modules/context/context.go b/modules/context/context.go index eecad20606..59bf897928 100644 --- a/modules/context/context.go +++ b/modules/context/context.go @@ -197,9 +197,9 @@ func (ctx *Context) RedirectToFirst(location ...string) { continue } - // Unfortunately browsers consider a redirect Location with preceding "//" and "/\" as meaning redirect to "http(s)://REST_OF_PATH" + // Unfortunately browsers consider a redirect Location with preceding "//", "\\" and "/\" as meaning redirect to "http(s)://REST_OF_PATH" // Therefore we should ignore these redirect locations to prevent open redirects - if len(loc) > 1 && loc[0] == '/' && (loc[1] == '/' || loc[1] == '\\') { + if len(loc) > 1 && (loc[0] == '/' || loc[0] == '\\') && (loc[1] == '/' || loc[1] == '\\') { continue } |