Cwikius-Spring/spring-security
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-security.git synced 2025-06-14 16:12:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

SEC-2177: Striping off all leading schemes

Browse Source 
Striping off all leading schemes in the DefaultRedirectStrategy, so it
will be less vulnerable to open redirect phishing attacks. More info can
be found at SEC-2177 JIRA issue.
This commit is contained in:
Maciej Zasada 2013-06-12 16:04:15 +02:00 committed by Rob Winch
parent 537d8f974f
commit 9057fbe0ed
2 changed files with 16 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
web/src/main/java/org/springframework/security/web/DefaultRedirectStrategy.java
View File

@ -54,8 +54,9 @@ public class DefaultRedirectStrategy implements RedirectStrategy {
return url;
}
// Calculate the relative URL from the fully qualified URL, minus the scheme and base context.
url = url.substring(url.indexOf("://") + 3); // strip off scheme
// Calculate the relative URL from the fully qualified URL, minus the last
// occurrence of the scheme and base context.
url = url.substring(url.lastIndexOf("://") + 3); // strip off scheme
url = url.substring(url.indexOf(contextPath) + contextPath.length());
if (url.length() > 1 && url.charAt(0) == '/') {

13
web/src/test/java/org/springframework/security/web/DefaultRedirectStrategyTests.java
View File

@ -24,4 +24,17 @@ public class DefaultRedirectStrategyTests {
assertEquals("remainder", response.getRedirectedUrl());
}
@Test
public void contextRelativeUrlWithMultipleSchemesInHostnameIsHandledCorrectly() throws Exception {
DefaultRedirectStrategy rds = new DefaultRedirectStrategy();
rds.setContextRelative(true);
MockHttpServletRequest request = new MockHttpServletRequest();
request.setContextPath("/context");
MockHttpServletResponse response = new MockHttpServletResponse();
rds.sendRedirect(request, response, "http://http://context.blah.com/context/remainder");
assertEquals("remainder", response.getRedirectedUrl());
}
}