Skip to content

Commit e3d8e92

Browse files
authored
Prevent redirect to Host (2) (go-gitea#19175) (go-gitea#19186)
Backport go-gitea#19175 Unhelpfully Locations starting with `/\` will be converted by the browser to `//` because ... well I do not fully understand. Certainly the RFCs and MDN do not indicate that this would be expected. Providing "compatibility" with the (mis)behaviour of a certain proprietary OS is my suspicion. However, we clearly have to protect against this. Therefore we should reject redirection locations that match the regular expression: `^/[\\\\/]+` Reference go-gitea#9678 Signed-off-by: Andrew Thornton <[email protected]>
1 parent 6fc73a8 commit e3d8e92

File tree

1 file changed

+6
-0
lines changed

1 file changed

+6
-0
lines changed

modules/context/context.go

+6
Original file line numberDiff line numberDiff line change
@@ -181,6 +181,12 @@ func (ctx *Context) RedirectToFirst(location ...string) {
181181
continue
182182
}
183183

184+
// Unfortunately browsers consider a redirect Location with preceding "//" and "/\" as meaning redirect to "http(s)://REST_OF_PATH"
185+
// Therefore we should ignore these redirect locations to prevent open redirects
186+
if len(loc) > 1 && loc[0] == '/' && (loc[1] == '/' || loc[1] == '\\') {
187+
continue
188+
}
189+
184190
u, err := url.Parse(loc)
185191
if err != nil || ((u.Scheme != "" || u.Host != "") && !strings.HasPrefix(strings.ToLower(loc), strings.ToLower(setting.AppURL))) {
186192
continue

0 commit comments

Comments
 (0)