From e3d8e92bdc67562783de9a76b5b7842b68daeb48 Mon Sep 17 00:00:00 2001 From: zeripath Date: Wed, 23 Mar 2022 20:01:23 +0000 Subject: [PATCH] Prevent redirect to Host (2) (#19175) (#19186) Backport #19175 Unhelpfully Locations starting with `/\` will be converted by the browser to `//` because ... well I do not fully understand. Certainly the RFCs and MDN do not indicate that this would be expected. Providing "compatibility" with the (mis)behaviour of a certain proprietary OS is my suspicion. However, we clearly have to protect against this. Therefore we should reject redirection locations that match the regular expression: `^/[\\\\/]+` Reference #9678 Signed-off-by: Andrew Thornton --- modules/context/context.go | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/modules/context/context.go b/modules/context/context.go index fe49094479..7fae0b110f 100644 --- a/modules/context/context.go +++ b/modules/context/context.go @@ -181,6 +181,12 @@ func (ctx *Context) RedirectToFirst(location ...string) { continue } + // Unfortunately browsers consider a redirect Location with preceding "//" and "/\" as meaning redirect to "http(s)://REST_OF_PATH" + // Therefore we should ignore these redirect locations to prevent open redirects + if len(loc) > 1 && loc[0] == '/' && (loc[1] == '/' || loc[1] == '\\') { + continue + } + u, err := url.Parse(loc) if err != nil || ((u.Scheme != "" || u.Host != "") && !strings.HasPrefix(strings.ToLower(loc), strings.ToLower(setting.AppURL))) { continue