From d71a01f4fcc4bb5ca040889694c94a07e52fa50e Mon Sep 17 00:00:00 2001 From: grm Date: Fri, 18 Sep 2026 13:48:02 +0300 Subject: Security: Reject backslashes in post-login redirect targets safeNext only refused a second leading slash, but browsers treat "/\evil.com" as "//evil.com", so ?next= was still an open redirect after login. No path of ours contains a backslash, so any one is refused. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01Sd8UPWrvyYCLj97JexNw3A --- internal/web/handlers_auth.go | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'internal/web/handlers_auth.go') diff --git a/internal/web/handlers_auth.go b/internal/web/handlers_auth.go index 6c76d81..708285d 100644 --- a/internal/web/handlers_auth.go +++ b/internal/web/handlers_auth.go @@ -153,9 +153,11 @@ func (s *Server) handlePassword(w http.ResponseWriter, r *http.Request) { redirectOK(w, r, "/dashboard", s.tr(r, "Password changed.")) } -// safeNext only allows local paths as post-login redirect targets. +// safeNext only allows local paths as post-login redirect targets: one +// leading slash, and no backslash anywhere — browsers read "/\evil.com" as +// "//evil.com", and no path of ours has one. func safeNext(n string) string { - if strings.HasPrefix(n, "/") && !strings.HasPrefix(n, "//") { + if strings.HasPrefix(n, "/") && !strings.HasPrefix(n, "//") && !strings.Contains(n, `\`) { return n } return "" -- cgit v1.2.3