From d71a01f4fcc4bb5ca040889694c94a07e52fa50e Mon Sep 17 00:00:00 2001 From: grm Date: Fri, 18 Sep 2026 13:48:02 +0300 Subject: Security: Reject backslashes in post-login redirect targets safeNext only refused a second leading slash, but browsers treat "/\evil.com" as "//evil.com", so ?next= was still an open redirect after login. No path of ours contains a backslash, so any one is refused. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01Sd8UPWrvyYCLj97JexNw3A --- internal/web/handlers_auth.go | 6 ++++-- internal/web/web_test.go | 11 +++++++++++ 2 files changed, 15 insertions(+), 2 deletions(-) (limited to 'internal') diff --git a/internal/web/handlers_auth.go b/internal/web/handlers_auth.go index 6c76d81..708285d 100644 --- a/internal/web/handlers_auth.go +++ b/internal/web/handlers_auth.go @@ -153,9 +153,11 @@ func (s *Server) handlePassword(w http.ResponseWriter, r *http.Request) { redirectOK(w, r, "/dashboard", s.tr(r, "Password changed.")) } -// safeNext only allows local paths as post-login redirect targets. +// safeNext only allows local paths as post-login redirect targets: one +// leading slash, and no backslash anywhere — browsers read "/\evil.com" as +// "//evil.com", and no path of ours has one. func safeNext(n string) string { - if strings.HasPrefix(n, "/") && !strings.HasPrefix(n, "//") { + if strings.HasPrefix(n, "/") && !strings.HasPrefix(n, "//") && !strings.Contains(n, `\`) { return n } return "" diff --git a/internal/web/web_test.go b/internal/web/web_test.go index 42d3b3a..7f66085 100644 --- a/internal/web/web_test.go +++ b/internal/web/web_test.go @@ -1003,3 +1003,14 @@ func TestHTTPSAndTrustProxy(t *testing.T) { t.Errorf("clientIP without TRUST_PROXY = %q, want the peer", ip) } } + +func TestSafeNext(t *testing.T) { + for in, want := range map[string]string{ + "/b/alice/": "/b/alice/", "/dashboard?x=1": "/dashboard?x=1", + "//evil.com": "", `/\evil.com`: "", `/b/\x/`: "", "http://evil.com": "", "dashboard": "", "": "", + } { + if got := safeNext(in); got != want { + t.Errorf("safeNext(%q) = %q, want %q", in, got, want) + } + } +} -- cgit v1.2.3