From 303ecbefdeb43a827217b8d52fdb308e9783be23 Mon Sep 17 00:00:00 2001
From: Lauris BH <lauris@nix.lv>
Date: Thu, 8 Jun 2023 17:08:14 +0300
Subject: [PATCH] Fix open redirect check for more cases (#25143)
If redirect_to parameter has set value starting with `\\example.com`
redirect will be created with header `Location: /\\example.com` that
will redirect to example.com domain.
---
modules/context/context.go | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/modules/context/context.go b/modules/context/context.go
index eecad20606102..59bf897928f81 100644
--- a/modules/context/context.go
+++ b/modules/context/context.go
@@ -197,9 +197,9 @@ func (ctx *Context) RedirectToFirst(location ...string) {
continue
}
- // Unfortunately browsers consider a redirect Location with preceding "//" and "/\" as meaning redirect to "http(s)://REST_OF_PATH"
+ // Unfortunately browsers consider a redirect Location with preceding "//", "\\" and "/\" as meaning redirect to "http(s)://REST_OF_PATH"
// Therefore we should ignore these redirect locations to prevent open redirects
- if len(loc) > 1 && loc[0] == '/' && (loc[1] == '/' || loc[1] == '\\') {
+ if len(loc) > 1 && (loc[0] == '/' || loc[0] == '\\') && (loc[1] == '/' || loc[1] == '\\') {
continue
}