diff options
| -rw-r--r-- | internal/web/handlers_auth.go | 6 | ||||
| -rw-r--r-- | internal/web/web_test.go | 11 |
2 files changed, 15 insertions, 2 deletions
diff --git a/internal/web/handlers_auth.go b/internal/web/handlers_auth.go index 6c76d81..708285d 100644 --- a/internal/web/handlers_auth.go +++ b/internal/web/handlers_auth.go @@ -153,9 +153,11 @@ func (s *Server) handlePassword(w http.ResponseWriter, r *http.Request) { redirectOK(w, r, "/dashboard", s.tr(r, "Password changed.")) } -// safeNext only allows local paths as post-login redirect targets. +// safeNext only allows local paths as post-login redirect targets: one +// leading slash, and no backslash anywhere — browsers read "/\evil.com" as +// "//evil.com", and no path of ours has one. func safeNext(n string) string { - if strings.HasPrefix(n, "/") && !strings.HasPrefix(n, "//") { + if strings.HasPrefix(n, "/") && !strings.HasPrefix(n, "//") && !strings.Contains(n, `\`) { return n } return "" diff --git a/internal/web/web_test.go b/internal/web/web_test.go index 42d3b3a..7f66085 100644 --- a/internal/web/web_test.go +++ b/internal/web/web_test.go @@ -1003,3 +1003,14 @@ func TestHTTPSAndTrustProxy(t *testing.T) { t.Errorf("clientIP without TRUST_PROXY = %q, want the peer", ip) } } + +func TestSafeNext(t *testing.T) { + for in, want := range map[string]string{ + "/b/alice/": "/b/alice/", "/dashboard?x=1": "/dashboard?x=1", + "//evil.com": "", `/\evil.com`: "", `/b/\x/`: "", "http://evil.com": "", "dashboard": "", "": "", + } { + if got := safeNext(in); got != want { + t.Errorf("safeNext(%q) = %q, want %q", in, got, want) + } + } +} |