CVE-2021-23495 (JavaScript, published 2022-02-25T20:15Z)
Description: value: The package karma before 6.3.16 are vulnerable to Open Redirect due to missing validation of the return_url query parameter.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/karma-runner/karma
Files changed:
client/karma.js
docs/config/01-configuration-file.md
lib/config.js
static/karma.js
test/client/karma.spec.js
Commit message: fix(security): mitigate the "Open Redirect Vulnerability"


Vulnerable code:
      if (!/^https?:\/\//.test(returnUrl)) {
} catch (e) {}
} catch (e) {}
} catch (e) {}
      clearContext: true
      if (!/^https?:\/\//.test(returnUrl)) {
    it('should navigate the client to return_url if specified', function (done) {
      ck.config = {}
      sinon.spy(socket, 'disconnect')

Fixed code:
      var isReturnUrlAllowed = false
      for (var i = 0; i < this.config.allowedReturnUrlPatterns.length; i++) {
        var allowedReturnUrlPattern = new RegExp(this.config.allowedReturnUrlPatterns[i])
        if (allowedReturnUrlPattern.test(returnUrl)) {
          isReturnUrlAllowed = true
          break
        }
      }
      if (!isReturnUrlAllowed) {
## client.allowedReturnUrlPatterns
**Type:** Array

**Default:** `['^https?://']`

**Description:** Define the string representations of the regular expressions that will be allowed for the `return_url` query parameter.

If the value of the `return_url` query parameter does not match any regular expression derived from the string representation of each of the elements of this array, navigation to it will be blocked.

} catch {}
} catch {}
} catch {}
      clearContext: true,
      allowedReturnUrlPatterns: ['^https?://']
      var isReturnUrlAllowed = false
      for (var i = 0; i < this.config.allowedReturnUrlPatterns.length; i++) {
        var allowedReturnUrlPattern = new RegExp(this.config.allowedReturnUrlPatterns[i])
        if (allowedReturnUrlPattern.test(returnUrl)) {
          isReturnUrlAllowed = true
          break
        }
      }
      if (!isReturnUrlAllowed) {
    it('should navigate the client to return_url if specified and allowed', function (done) {
      var config = {
        // The default value.
        allowedReturnUrlPatterns: ['^https?://']
      }
      socket.emit('execute', config)
    it('should not navigate the client to return_url if not allowed', function () {
      var config = {
        allowedReturnUrlPatterns: []
      }

      windowLocation.search = '?id=567&return_url=javascript:alert(document.domain)'
      socket = new MockSocket()
      k = new ClientKarma(updater, socket, iframe, windowStub, windowNavigator, windowLocation)
      clientWindow = { karma: k }
      ck = new ContextKarma(ContextKarma.getDirectCallParentKarmaMethod(clientWindow))
      socket.emit('execute', config)

      try {
        ck.complete()
        throw new Error('An error should have been caught.')
      } catch (error) {
        assert(/Error: Security: Navigation to .* was blocked to prevent malicious exploits./.test(error))
      }
    })