Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom

Prevent redirect to Host (2) #19175

Merged
merged 6 commits into from
Mar 23, 2022
Merged

Prevent redirect to Host (2) #19175

merged 6 commits into from
Mar 23, 2022

Commits on Mar 22, 2022

  1. Prevent redirect to Host (2) 

    Unhelpfully Locations starting with `/\` will be converted by the
browser to `//` because ... well I do not fully understand. Certainly
the RFCs and MDN do not indicate that this would be expected. Providing
"compatibility" with the (mis)behaviour of a certain proprietary OS is
my suspicion. However, we clearly have to protect against this.

Therefore we should reject redirection locations that match the regular
expression: `^/[\\\\/]+`

Reference go-gitea#9678

Signed-off-by: Andrew Thornton <art27@cantab.net>
    @zeripath
    zeripath committed Mar 22, 2022
    Configuration menu
    Copy the full SHA
    8e97a93 View commit details
    Browse the repository at this point in the history

Commits on Mar 23, 2022

  1. simplify 

    Signed-off-by: Andrew Thornton <art27@cantab.net>
    @zeripath
    zeripath committed Mar 23, 2022
    Configuration menu
    Copy the full SHA
    ca59d88 View commit details
    Browse the repository at this point in the history

  2. Merge remote-tracking branch 'origin/main' into prevent-redirect-to-h… 

    …ost-2
    @zeripath
    zeripath committed Mar 23, 2022
    Configuration menu
    Copy the full SHA
    8b68aa5 View commit details
    Browse the repository at this point in the history

  3. as per review 

    Signed-off-by: Andrew Thornton <art27@cantab.net>
    @zeripath
    zeripath committed Mar 23, 2022
    Configuration menu
    Copy the full SHA
    f907294 View commit details
    Browse the repository at this point in the history

  4. Merge branch 'main' into prevent-redirect-to-host-2

    @lafriks
    lafriks authored Mar 23, 2022
    Configuration menu
    Copy the full SHA
    de099c7 View commit details
    Browse the repository at this point in the history

  5. Merge branch 'main' into prevent-redirect-to-host-2

    @zeripath
    zeripath authored Mar 23, 2022
    Configuration menu
    Copy the full SHA
    892c70e View commit details
    Browse the repository at this point in the history