artin/sourcegraph
1
0
Fork 0
mirror of https://github.com/sourcegraph/sourcegraph.git synced 2026-02-06 19:21:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

auth: ensure the redirect URL always starts with a single slash (#10167)

Browse Source 
Co-Authored-By: Keegan Carruthers-Smith <keegan.csmith@gmail.com>
This commit is contained in:
ᴜɴᴋɴᴡᴏɴ 2020-04-24 18:06:39 +08:00 committed by GitHub
parent 2555ef0e46
commit bde46f4ae8
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 14 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
cmd/frontend/auth/redirect.go
View File

@ -2,6 +2,7 @@ package auth
import (
"net/url"
"path"
"strings"
)
@ -15,6 +16,9 @@ func SafeRedirectURL(urlStr string) string {
return "/"
}
// Make sure u.Path always starts with a single slash.
u.Path = path.Clean(u.Path)
// Only take certain known-safe fields.
u = &url.URL{Path: u.Path, RawQuery: u.RawQuery}
return u.String()

19
cmd/frontend/auth/redirect_test.go
View File

@ -4,15 +4,16 @@ import "testing"
func TestSafeRedirectURL(t *testing.T) {
tests := map[string]string{
"": "/",
"/": "/",
"a@b.com:c": "/",
"a@b.com/c": "/",
"//a": "/",
"http://a.com/b": "/b",
"//a.com/b": "/b",
"//a@b.com/c": "/c",
"/a?b": "/a?b",
"": "/",
"/": "/",
"a@b.com:c": "/",
"a@b.com/c": "/",
"//a": "/",
"http://a.com/b": "/b",
"//a.com/b": "/b",
"//a@b.com/c": "/c",
"/a?b": "/a?b",
"//foo//example.com": "/example.com",
}
for input, want := range tests {
got := SafeRedirectURL(input)