Cwikius-Spring
/
spring-security
mirror of https://github.com/spring-projects/spring-security.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SEC-2177: Striping off all leading schemes 

Striping off all leading schemes in the DefaultRedirectStrategy, so it
will be less vulnerable to open redirect phishing attacks. More info can
be found at SEC-2177 JIRA issue.
This commit is contained in:
Maciej Zasada 2013-06-12 16:04:15 +02:00 committed by Rob Winch
parent 5be4bfd55e
commit 7cf37856c0
2 changed files with 16 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
web/src/main/java/org/springframework/security/web/DefaultRedirectStrategy.java
View File

@ -54,8 +54,9 @@ public class DefaultRedirectStrategy implements RedirectStrategy {
return url;
}
// Calculate the relative URL from the fully qualified URL, minus the scheme and base context.
url = url.substring(url.indexOf("://") + 3); // strip off scheme
// Calculate the relative URL from the fully qualified URL, minus the last
// occurrence of the scheme and base context.
url = url.substring(url.lastIndexOf("://") + 3); // strip off scheme
url = url.substring(url.indexOf(contextPath) + contextPath.length());
if (url.length() > 1 && url.charAt(0) == '/') {

13
web/src/test/java/org/springframework/security/web/DefaultRedirectStrategyTests.java
View File

@ -24,4 +24,17 @@ public class DefaultRedirectStrategyTests {
assertEquals("remainder", response.getRedirectedUrl());
}
@Test
public void contextRelativeUrlWithMultipleSchemesInHostnameIsHandledCorrectly() throws Exception {
DefaultRedirectStrategy rds = new DefaultRedirectStrategy();
rds.setContextRelative(true);
MockHttpServletRequest request = new MockHttpServletRequest();
request.setContextPath("/context");
MockHttpServletResponse response = new MockHttpServletResponse();
rds.sendRedirect(request, response, "http://http://context.blah.com/context/remainder");
assertEquals("remainder", response.getRedirectedUrl());
}
}