go/authboss
1
0
Fork 0
mirror of https://github.com/volatiletech/authboss.git synced 2025-01-22 05:09:42 +02:00
Code Issues Releases Activity

Merge branch 'rbren/patch-1' into master

Browse Source
This commit is contained in:
Aaron L 2020-09-17 22:06:48 -07:00
commit 0a2c2aafa0
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
defaults/responder.go
View File

@ -77,6 +77,10 @@ func (r *Redirector) Redirect(w http.ResponseWriter, req *http.Request, ro authb
func (r Redirector) redirectAPI(w http.ResponseWriter, req *http.Request, ro authboss.RedirectOptions) error {
path := ro.RedirectPath
redir := req.FormValue(r.FormValueName)
if strings.Contains(redir, "://") {
// Guard against Open Redirect: https://cwe.mitre.org/data/definitions/601.html
redir = ""
}
if len(redir) != 0 && ro.FollowRedirParam {
path = redir
}