github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2024-11-23 03:16:41 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

SECURITY: Don't allow redirects with periods in case you don't control

Browse Source 
other tlds on the same domain.
This commit is contained in:
Robin Ward 2014-10-30 11:31:44 -04:00
parent 59cc2476a1
commit 316f1bea04
2 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
app/controllers/static_controller.rb
View File

@ -65,7 +65,9 @@ class StaticController < ApplicationController
begin
forum_uri = URI(Discourse.base_url)
uri = URI(params[:redirect])
if uri.path.present? && (uri.host.blank? || uri.host == forum_uri.host)
if uri.path.present? &&
(uri.host.blank? || uri.host == forum_uri.host) &&
uri.path !~ /\./
destination = uri.path
end
rescue URI::InvalidURIError

7
spec/controllers/static_controller_spec.rb
View File

@ -89,6 +89,13 @@ describe StaticController do
end
end
context 'with a period to force a new host' do
it 'redirects to the root path' do
xhr :post, :enter, redirect: ".org/foo"
expect(response).to redirect_to '/'
end
end
context 'with a full url to someone else' do
it 'redirects to the root path' do
xhr :post, :enter, redirect: "http://eviltrout.com/foo"