nscendoni opened a new pull request, #52: URL: https://github.com/apache/sling-org-apache-sling-auth-oauth-client/pull/52
The application-controlled post-login redirect parameter had weak validation and was decoded twice on the OAuth callback path, which together could turn a validated value into a protocol-relative URL (e.g. //evil.com). On a servlet container/proxy that emits a relative Location header, this enables an open redirect. - OAuthCallbackServlet.handleRedirect: stop URL-decoding the redirect a second time; use the value stored in the encrypted state cookie verbatim, and re-validate it as defense in depth right before sendRedirect. - RedirectHelper.validateRedirect: replace the weak denylist (reject leading '//') with a positive check (isSafeRelativePath) that requires a single leading '/' and rejects '//', '/\', any embedded backslash, control characters, and any value that parses to a URI with a scheme/authority/host. - OidcAuthenticationHandler.getAuthenticationRequestUri: validate the request.getRequestURI() fallback (used when no redirect parameter is supplied) instead of using it unchecked, failing safe (no post-login redirect) if validation fails. - Add regression tests for the double-decode bypass, the backslash denylist bypass, direct isSafeRelativePath edge cases, and the unsafe request-URI fallback. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
