diff options
Diffstat (limited to 'internal/web/handlers_auth.go')
| -rw-r--r-- | internal/web/handlers_auth.go | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/internal/web/handlers_auth.go b/internal/web/handlers_auth.go index 6c76d81..708285d 100644 --- a/internal/web/handlers_auth.go +++ b/internal/web/handlers_auth.go @@ -153,9 +153,11 @@ func (s *Server) handlePassword(w http.ResponseWriter, r *http.Request) { redirectOK(w, r, "/dashboard", s.tr(r, "Password changed.")) } -// safeNext only allows local paths as post-login redirect targets. +// safeNext only allows local paths as post-login redirect targets: one +// leading slash, and no backslash anywhere — browsers read "/\evil.com" as +// "//evil.com", and no path of ours has one. func safeNext(n string) string { - if strings.HasPrefix(n, "/") && !strings.HasPrefix(n, "//") { + if strings.HasPrefix(n, "/") && !strings.HasPrefix(n, "//") && !strings.Contains(n, `\`) { return n } return "" |