CVE-2022-24739: URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
value: alltube is an html front end for youtube-dl. On releases prior to 3.0.3, an attacker could craft a special HTML page to trigger either an open redirect attack or a Server-Side Request Forgery attack (depending on how AllTube is configured). The impact is mitigated by the fact the SSRF attack is only possible when the `stream` option is enabled in the configuration. (This option is disabled by default.) 3.0.3 contains a fix for this vulnerability.
CWE description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
CVSS v3 base score: 6.1
Published: 2022-03-08T22:15Z
Repository: https://github.com/Rudloff/alltube
Language: PHP
Files changed: classes/Factory/ViewFactory.php, index.php, templates/inc/logo.tpl
Commit date: 2022-02-20 13:28:57 +0100
Commit message: Don't redirect to REQUEST_URI when browsing to index.php
Instead, we can make sure everything works correctly on index.php

Diff: diff --git a/classes/Factory/ViewFactory.php b/classes/Factory/ViewFactory.php
index 591369d..1b9fe6c 100644
--- a/classes/Factory/ViewFactory.php
+++ b/classes/Factory/ViewFactory.php
@@ -35,10 +35,29 @@ class ViewFactory
         return $uri->withBasePath('')
             ->withHost('alltubedownload.net')
             ->withScheme('https');
     }
 
+    /**
+     * @param Uri $uri
+     * @return Uri
+     */
+    private static function cleanBasePath(Uri $uri): Uri
+    {
+        $basePath = $uri->getBasePath();
+        if (str_ends_with($basePath, 'index.php')) {
+            /*
+             * When the base path ends with index.php,
+             * routing works correctly, but it breaks the URL of static assets using {base_url}.
+             * So we alter the base path but only in the URI used by SmartyPlugins.
+             */
+            $uri = $uri->withBasePath(dirname($basePath));
+        }
+
+        return $uri;
+    }
+
     /**
      * Create Smarty view object.
      *
      * @param ContainerInterface $container Slim dependency container
      * @param Request|null $request PSR-7 request
@@ -74,10 +93,12 @@ class ViewFactory
         }
 
         /** @var LocaleManager $localeManager */
         $localeManager = $container->get('locale');
 
+        $uri = self::cleanBasePath($uri);
+
         $smartyPlugins = new SmartyPlugins($container->get('router'), $uri->withUserInfo(''));
         $view->registerPlugin('function', 'path_for', [$smartyPlugins, 'pathFor']);
         $view->registerPlugin('function', 'base_url', [$smartyPlugins, 'baseUrl']);
         $view->registerPlugin('block', 't', [$localeManager, 'smartyTranslate']);
 
diff --git a/index.php b/index.php
index 112fb7d..0ca2302 100644
--- a/index.php
+++ b/index.php
@@ -3,15 +3,10 @@
 require_once __DIR__ . '/vendor/autoload.php';
 
 use Alltube\App;
 use Alltube\ErrorHandler;
 
-if (isset($_SERVER['REQUEST_URI']) && strpos($_SERVER['REQUEST_URI'], '/index.php') !== false) {
-    header('Location: ' . str_ireplace('/index.php', '/', $_SERVER['REQUEST_URI']));
-    die;
-}
-
 try {
     // Create app.
     $app = new App();
 
     $app->run();
diff --git a/templates/inc/logo.tpl b/templates/inc/logo.tpl
index b1da44f..47b70b3 100644
--- a/templates/inc/logo.tpl
+++ b/templates/inc/logo.tpl
@@ -1,5 +1,5 @@
 <h1 class="logobis">
-    <a class="logocompatible" href="{base_url}">
+    <a class="logocompatible" href="{path_for name="index"}">
         <span class="logocompatiblemask"><img src="{base_url}/img/logocompatiblemask.png" width="447" height="107"
                                               alt="{$config->appName}"/></span>
     </a></h1>

Vulnerable code: if (isset($_SERVER['REQUEST_URI']) && strpos($_SERVER['REQUEST_URI'], '/index.php') !== false) {
    header('Location: ' . str_ireplace('/index.php', '/', $_SERVER['REQUEST_URI']));
    die;
}

    <a class="logocompatible" href="{base_url}">
Fixed code:     /**
     * @param Uri $uri
     * @return Uri
     */
    private static function cleanBasePath(Uri $uri): Uri
    {
        $basePath = $uri->getBasePath();
        if (str_ends_with($basePath, 'index.php')) {
            /*
             * When the base path ends with index.php,
             * routing works correctly, but it breaks the URL of static assets using {base_url}.
             * So we alter the base path but only in the URI used by SmartyPlugins.
             */
            $uri = $uri->withBasePath(dirname($basePath));
        }

        return $uri;
    }

        $uri = self::cleanBasePath($uri);

    <a class="logocompatible" href="{path_for name="index"}">