hanicz opened a new pull request, #1346: URL: https://github.com/apache/knox/pull/1346
[KNOX-3416](https://issues.apache.org/jira/browse/KNOX-3416) - KnoxSSO redirects to untrusted site ## What changes were proposed in this pull request? KnoxSSO open redirect. `originalUrl=https://<knox-host>:443%[email protected]/` bypassed the redirect whitelist — the whitelist check decoded the URL twice (seeing host <knox-host>), but the browser got the once-decoded Location and resolved the host to malicious.link. The `%2f@` trick hid the real host behind `userinfo`. In `WebSSOResource`, reject any redirect target containing `userinfo` (user@host) — checked on original, the exact value emitted in the Location header. Malformed URLs and `userinfo` results in 400. New unit tests for the scenario. ## How was this patch tested? Unit tests **Before:** ``` curl -iku guest:guest-password 'https://localhost:8443/gateway/knoxsso/api/v1/websso?originalUrl=https://localhost:8443%[email protected]/' HTTP/1.1 307 Temporary Redirect Date: Wed, 12 Aug 2026 11:34:14 GMT X-Frame-Options: DENY Expires: Thu, 01 Jan 1970 00:00:00 GMT Location: https://localhost:[email protected]/ Content-Length: 0 ``` **After:** ``` curl -iku guest:guest-password 'https://localhost:8443/gateway/knoxsso/api/v1/websso?originalUrl=https://localhost:8443%[email protected]/' HTTP/1.1 400 Bad Request X-Frame-Options: DENY Set-Cookie: KNOXSESSIONID=node01c8rf5xqxudkxxp4188wx0kg70.node0; Path=/gateway/knoxsso; Secure; HttpOnly Set-Cookie: rememberMe=deleteMe; Path=/gateway/knoxsso; Max-Age=0; Expires=Tue, 11-Aug-2026 11:37:11 GMT; SameSite=lax Cache-Control: must-revalidate,no-cache,no-store Content-Type: text/html;charset=iso-8859-1 Content-Length: 419 <html> <head> <meta http-equiv="Content-Type" content="text/html;charset=ISO-8859-1"/> <title>Error 400 Bad Request</title> </head> <body><h2>HTTP ERROR 400 Bad Request</h2> <table> <tr><th>URI:</th><td>/gateway/knoxsso/api/v1/websso</td></tr> <tr><th>STATUS:</th><td>400</td></tr> <tr><th>MESSAGE:</th><td>Bad Request</td></tr> <tr><th>SERVLET:</th><td>knoxsso-knox-gateway-servlet</td></tr> </table> </body> </html> ``` ## Integration Tests N/A ## UI changes N/A -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
