mirror of https://github.com/go-gitea/gitea.git
Backport #25143 by @lafriks If redirect_to parameter has set value starting with `\\example.com` redirect will be created with header `Location: /\\example.com` that will redirect to example.com domain. Co-authored-by: Lauris BH <lauris@nix.lv>pull/25161/head
parent
82a8c26bbf
commit
7679f4d51a
|
@ -49,9 +49,9 @@ func (ctx *Context) RedirectToFirst(location ...string) {
|
||||||
continue
|
continue
|
||||||
}
|
}
|
||||||
|
|
||||||
// Unfortunately browsers consider a redirect Location with preceding "//" and "/\" as meaning redirect to "http(s)://REST_OF_PATH"
|
// Unfortunately browsers consider a redirect Location with preceding "//", "\\" and "/\" as meaning redirect to "http(s)://REST_OF_PATH"
|
||||||
// Therefore we should ignore these redirect locations to prevent open redirects
|
// Therefore we should ignore these redirect locations to prevent open redirects
|
||||||
if len(loc) > 1 && loc[0] == '/' && (loc[1] == '/' || loc[1] == '\\') {
|
if len(loc) > 1 && (loc[0] == '/' || loc[0] == '\\') && (loc[1] == '/' || loc[1] == '\\') {
|
||||||
continue
|
continue
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue