Mark,
On 8/22/23 15:22, ma...@apache.org wrote:
This is an automated email from the ASF dual-hosted git repository.
markt pushed a commit to branch cve-2023-41080
in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit e3703c9abb8fe0d5602f6ba8a8f11d4b6940815a
Author: Mark Thomas <ma...@apache.org>
AuthorDate: Tue Aug 22 11:31:23 2023 -0700
Avoid protocol relative redirects
---
java/org/apache/catalina/authenticator/FormAuthenticator.java | 6 ++++++
webapps/docs/changelog.xml | 3 +++
2 files changed, 9 insertions(+)
diff --git a/java/org/apache/catalina/authenticator/FormAuthenticator.java
b/java/org/apache/catalina/authenticator/FormAuthenticator.java
index 5487ec87a8..9dd5635ca8 100644
--- a/java/org/apache/catalina/authenticator/FormAuthenticator.java
+++ b/java/org/apache/catalina/authenticator/FormAuthenticator.java
@@ -742,6 +742,12 @@ public class FormAuthenticator extends AuthenticatorBase {
sb.append('?');
sb.append(saved.getQueryString());
}
+
+ // Avoid protocol relative redirects
+ while (sb.length() > 1 && sb.charAt(1) == '/') {
+ sb.deleteCharAt(0);
+ }
Are there any previous guarantees that sb.charAt(0) is a '/'?
I'm wondering if we shouldn't just blindly delete the first character
instead of the second.
Unrelated, I wonder if this method still needs a StringBuilder at all.
-chris
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index e4d3072d31..a45195dfc1 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -125,6 +125,9 @@
exceptions. As a consequence, the <code>FailedRequestFilter</code> has
been removed. (markt)
</add>
+ <fix>
+ Avoid protocol relative redirects in FORM authentication. (markt)
+ </fix>
</changelog>
</subsection>
<subsection name="Web applications">
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org
