IntenseWebs/discourse
3
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-02-25 18:55:32 -06:00
Code Issues Packages Projects Releases Wiki Activity

SECURITY: Don't allow redirects with periods in case you don't control

Browse Source 
other tlds on the same domain.
This commit is contained in:
Robin Ward 2014-10-30 11:31:44 -04:00
parent 59cc2476a1
commit 316f1bea04
2 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
app/controllers/static_controller.rb
View File

@ -65,7 +65,9 @@ class StaticController < ApplicationController
begin begin
forum_uri = URI(Discourse.base_url) forum_uri = URI(Discourse.base_url)
uri = URI(params[:redirect]) uri = URI(params[:redirect])
if uri.path.present? && (uri.host.blank? || uri.host == forum_uri.host) if uri.path.present? &&
(uri.host.blank? || uri.host == forum_uri.host) &&
uri.path !~ /\./
destination = uri.path destination = uri.path
end end
rescue URI::InvalidURIError rescue URI::InvalidURIError

7
spec/controllers/static_controller_spec.rb
View File

@ -89,6 +89,13 @@ describe StaticController do
end end
end end
context 'with a period to force a new host' do
it 'redirects to the root path' do
xhr :post, :enter, redirect: ".org/foo"
expect(response).to redirect_to '/'
end
end
context 'with a full url to someone else' do context 'with a full url to someone else' do
it 'redirects to the root path' do it 'redirects to the root path' do
xhr :post, :enter, redirect: "http://eviltrout.com/foo" xhr :post, :enter, redirect: "http://eviltrout.com/foo"