Nicola Scendoni created SLING-13363:
---------------------------------------
Summary: Open-redirect hardening gaps in post-login redirect
parameter handling (Sling OAuth Client) — defense-in-depth
Key: SLING-13363
URL: https://issues.apache.org/jira/browse/SLING-13363
Project: Sling
Issue Type: Bug
Components: Extensions
Affects Versions: OAuth Client 0.1.6
Reporter: Nicola Scendoni
The application-controlled post-login redirect parameter (
RedirectHelper.PARAMETER_NAME_REDIRECT ) has weak validation and is decoded
twice on the OAuth callback path, which together can turn a validated value
into a protocol-relative URL (e.g. //evil.com ). This has no effect on the
tested instance, because the servlet container resolves //evil.com against
the request host and emits an absolute Location header (same-origin).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
