[
https://issues.apache.org/jira/browse/SLING-13363?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18118847#comment-18118847
]
Nicola Scendoni commented on SLING-13363:
-----------------------------------------
PR: [https://github.com/apache/sling-org-apache-sling-auth-oauth-client/pull/52]
> Open-redirect hardening gaps in post-login redirect parameter handling
> (Sling OAuth Client) — defense-in-depth
> ----------------------------------------------------------------------------------------------------------------
>
> Key: SLING-13363
> URL: https://issues.apache.org/jira/browse/SLING-13363
> Project: Sling
> Issue Type: Bug
> Components: Extensions
> Affects Versions: OAuth Client 0.1.6
> Reporter: Nicola Scendoni
> Priority: Major
>
> The application-controlled post-login redirect parameter (
> RedirectHelper.PARAMETER_NAME_REDIRECT ) has weak validation and is decoded
> twice on the OAuth callback path, which together can turn a validated value
> into a protocol-relative URL (e.g. //evil.com ). This has no effect on the
> tested instance, because the servlet container resolves //evil.com against
> the request host and emits an absolute Location header (same-origin).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
