diff options
| author | Giteabot <teabot@gitea.io> | 2023-06-08 12:03:42 -0400 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-06-08 18:03:42 +0200 |
| commit | 7679f4d51a637ae47880e09dbb185651cb7163c7 (patch) | |
| tree | 4282c73360ac8ea56c454d772dd24a757d9314a7 /modules/context | |
| parent | 82a8c26bbfec4774cf7975f14468202a1560e418 (diff) | |
| download | gitea-7679f4d51a637ae47880e09dbb185651cb7163c7.tar.gz gitea-7679f4d51a637ae47880e09dbb185651cb7163c7.zip | |
Fix open redirect check for more cases (#25143) (#25154)
Backport #25143 by @lafriks
If redirect_to parameter has set value starting with `\\example.com`
redirect will be created with header `Location: /\\example.com` that
will redirect to example.com domain.
Co-authored-by: Lauris BH <lauris@nix.lv>
Diffstat (limited to 'modules/context')
| -rw-r--r-- | modules/context/context_response.go | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/modules/context/context_response.go b/modules/context/context_response.go index aeeb51ba37..1f215eb8ad 100644 --- a/modules/context/context_response.go +++ b/modules/context/context_response.go @@ -49,9 +49,9 @@ func (ctx *Context) RedirectToFirst(location ...string) { continue } - // Unfortunately browsers consider a redirect Location with preceding "//" and "/\" as meaning redirect to "http(s)://REST_OF_PATH" + // Unfortunately browsers consider a redirect Location with preceding "//", "\\" and "/\" as meaning redirect to "http(s)://REST_OF_PATH" // Therefore we should ignore these redirect locations to prevent open redirects - if len(loc) > 1 && loc[0] == '/' && (loc[1] == '/' || loc[1] == '\\') { + if len(loc) > 1 && (loc[0] == '/' || loc[0] == '\\') && (loc[1] == '/' || loc[1] == '\\') { continue } |