Skip to content

Commit a259a92

Browse files
lafriksearl-warren
authored andcommitted
Fix open redirect check for more cases (go-gitea#25143) (go-gitea#25155)
Backport go-gitea#25143 If redirect_to parameter has set value starting with \\example.com redirect will be created with header Location: /\\example.com that will redirect to example.com domain. (cherry picked from commit a903005)
1 parent 719dddd commit a259a92

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

modules/context/context.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -197,9 +197,9 @@ func (ctx *Context) RedirectToFirst(location ...string) {
197197
continue
198198
}
199199

200-
// Unfortunately browsers consider a redirect Location with preceding "//" and "/\" as meaning redirect to "http(s)://REST_OF_PATH"
200+
// Unfortunately browsers consider a redirect Location with preceding "//", "\\" and "/\" as meaning redirect to "http(s)://REST_OF_PATH"
201201
// Therefore we should ignore these redirect locations to prevent open redirects
202-
if len(loc) > 1 && loc[0] == '/' && (loc[1] == '/' || loc[1] == '\\') {
202+
if len(loc) > 1 && (loc[0] == '/' || loc[0] == '\\') && (loc[1] == '/' || loc[1] == '\\') {
203203
continue
204204
}
205205

0 commit comments

Comments
 (0)