Backport fix for open redirects from upstream project

Securepoint · Oct 26, 2023 · f3e0c3f · f3e0c3f · Primexz · Oct 26, 2023
1 parent 1d52c9f
commit f3e0c3f
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 2 deletions.
diff --git a/oauthproxy.go b/oauthproxy.go
@@ -34,6 +34,12 @@ var SignatureHeaders []string = []string{
 	"Gap-Auth",
 }
 
+var (
+	// Used to check final redirects are not susceptible to open redirects.
+	// Matches //, /\ and both of these with whitespace in between (eg / / or / \).
+	invalidRedirectRegex = regexp.MustCompile(`[/\\](?:[\s\v]*|\.{1,2})[/\\]`)
+)
+
 type OAuthProxy struct {
 	CookieSeed     string
 	CookieName     string
@@ -422,7 +428,7 @@ func (p *OAuthProxy) GetRedirect(req *http.Request) (redirect string, err error)
 	}
 
 	redirect = req.Form.Get("rd")
-	if redirect == "" || !strings.HasPrefix(redirect, "/") || strings.HasPrefix(redirect, "//") {
+	if redirect == "" || !strings.HasPrefix(redirect, "/") || strings.HasPrefix(redirect, "//") || invalidRedirectRegex.MatchString(redirect) {
 		redirect = "/"
 	}
 

diff --git a/version.go b/version.go
@@ -1,3 +1,3 @@
 package main
 
-const VERSION = "2.2.2-securepoint"
+const VERSION = "2.2.3-securepoint"