mirror of
https://github.com/coder/coder.git
synced 2026-09-21 20:51:01 +08:00
McKayla はな
2f879910af
Closes DEVEX-604 Hardens `redirect` URL handling in the OAuth2/OIDC/external-auth callback flows so redirects are always reduced to a safe, relative path local to the application. Previously a redirect value with an opaque scheme (e.g. `javascript:...`) or a path with multiple leading slashes (e.g. `///evil.com`) could survive sanitization mostly intact. Also de-duplicates the previously copy-pasted `uriFromURL` helper (now exported `httpmw.URIFromURL`) so there's a single implementation shared by `coderd/userauth.go`, `coderd/externalauth.go`, and `coderd/httpmw/oauth2.go`. <details> <summary>Context</summary> Addresses a low-severity finding reported via a pentest disclosure: the redirect sanitizer used `url.Parse(...).RequestURI()`, which doesn't reject non-hierarchical (opaque) URLs and doesn't collapse extra leading slashes, so crafted `redirect` values could partially survive sanitization. </details> This PR was authored by a Coder Agent on behalf of @aslilac.
49 lines
1.9 KiB
Go
49 lines
1.9 KiB
Go
package httpapi_test
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/coder/coder/v2/coderd/httpapi"
|
|
)
|
|
|
|
func TestSafeRedirectPath(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
tests := []struct {
|
|
name string
|
|
in string
|
|
want string
|
|
}{
|
|
{"empty", "", "/"},
|
|
{"simple path", "/foo/bar", "/foo/bar"},
|
|
{"path with query", "/foo/bar?baz=qux", "/foo/bar?baz=qux"},
|
|
{"path with fragment", "/foo/bar#wooble", "/foo/bar#wooble"},
|
|
{"path with query+fragment", "/foo/bar?wibble=wobble#wooble", "/foo/bar?wibble=wobble#wooble"},
|
|
{"no leading slash", "foo/bar", "/foo/bar"},
|
|
{"malformed", "http://[::1]:namedport", "/"},
|
|
// Ensure backslashes aren't a blindspot.
|
|
{"backslash after slash", `/\evil.example.com`, "/%5Cevil.example.com"},
|
|
{"leading double backslash", `\\evil.example.com`, "/%5C%5Cevil.example.com"},
|
|
{"backslash then slash", `\/evil.example.com`, "/%5C/evil.example.com"},
|
|
{"mixed slash backslash", `/\/evil.example.com`, "/%5C/evil.example.com"},
|
|
{"scheme with backslash", `https:/\evil.example.com`, "/%5Cevil.example.com"},
|
|
// Cure53 CDM-02-009: triple-slash open redirect.
|
|
{"protocol relative triple slash", "///evil.example.com", "/evil.example.com"},
|
|
{"protocol relative double slash", "//evil.example.com", "/"},
|
|
{"absolute url with host", "http://evil.example.com/path", "/path"},
|
|
{"absolute url with host and query", "https://evil.example.com/path?a=b", "/path?a=b"},
|
|
// Cure53 CDM-02-009: javascript: scheme bypassing CSP.
|
|
{"javascript scheme", "javascript:alert(origin)", "/"},
|
|
{"nested javascript scheme", "javascript:javascript:javascript:alert(origin)", "/"},
|
|
{"data scheme", "data:text/html,<script>alert(origin)</script>", "/"},
|
|
}
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
t.Parallel()
|
|
if got := httpapi.SafeRedirectPath(tt.in); got != tt.want {
|
|
t.Errorf("SafeRedirectPath(%q) = %q, want %q", tt.in, got, tt.want)
|
|
}
|
|
})
|
|
}
|
|
}
|