hanicz opened a new pull request, #1346:
URL: https://github.com/apache/knox/pull/1346

   
   [KNOX-3416](https://issues.apache.org/jira/browse/KNOX-3416) - KnoxSSO 
redirects to untrusted site
   
   ## What changes were proposed in this pull request?
   
   KnoxSSO open redirect. 
`originalUrl=https://<knox-host>:443%[email protected]/` bypassed the 
redirect whitelist — the whitelist check decoded the URL twice (seeing host 
<knox-host>), but the browser got the once-decoded Location and resolved the 
host to malicious.link. The `%2f@` trick hid the real host behind `userinfo`.
   
   In `WebSSOResource`, reject any redirect target containing `userinfo` 
(user@host) — checked on original, the exact value emitted in the Location 
header. Malformed URLs and `userinfo` results in 400.
   
   New unit tests for the scenario.
   
   ## How was this patch tested?
   
   Unit tests
   
   **Before:**
   
   ```
   curl -iku guest:guest-password 
'https://localhost:8443/gateway/knoxsso/api/v1/websso?originalUrl=https://localhost:8443%[email protected]/'
   HTTP/1.1 307 Temporary Redirect
   Date: Wed, 12 Aug 2026 11:34:14 GMT
   X-Frame-Options: DENY
   Expires: Thu, 01 Jan 1970 00:00:00 GMT
   Location: https://localhost:[email protected]/
   Content-Length: 0
   ```
   
   **After:**
   
   ```
   curl -iku guest:guest-password 
'https://localhost:8443/gateway/knoxsso/api/v1/websso?originalUrl=https://localhost:8443%[email protected]/'
   HTTP/1.1 400 Bad Request
   X-Frame-Options: DENY
   Set-Cookie: KNOXSESSIONID=node01c8rf5xqxudkxxp4188wx0kg70.node0; 
Path=/gateway/knoxsso; Secure; HttpOnly
   Set-Cookie: rememberMe=deleteMe; Path=/gateway/knoxsso; Max-Age=0; 
Expires=Tue, 11-Aug-2026 11:37:11 GMT; SameSite=lax
   Cache-Control: must-revalidate,no-cache,no-store
   Content-Type: text/html;charset=iso-8859-1
   Content-Length: 419
   
   <html>
   <head>
   <meta http-equiv="Content-Type" content="text/html;charset=ISO-8859-1"/>
   <title>Error 400 Bad Request</title>
   </head>
   <body><h2>HTTP ERROR 400 Bad Request</h2>
   <table>
   <tr><th>URI:</th><td>/gateway/knoxsso/api/v1/websso</td></tr>
   <tr><th>STATUS:</th><td>400</td></tr>
   <tr><th>MESSAGE:</th><td>Bad Request</td></tr>
   <tr><th>SERVLET:</th><td>knoxsso-knox-gateway-servlet</td></tr>
   </table>
   
   </body>
   </html>
   ```
   
   ## Integration Tests
   N/A
   
   ## UI changes
   N/A
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to