JedWatson/keystone — pull request #242 by oliverjenkins (2014-03-16 11:08:24+00:00)
Title: The from parameter redirect on signin is not validated and allows for open redirects.

Hi there,

I'm really enjoying working with Keystone, and have been very impressed with it. I did notice something with the redirect following sign-in.

The req.querystring.from parameter is not validated. It will redirect the user to any url. It is vulnerable to an open redirect. This page has more details https://www.owasp.org/index.php/Top_10_2013-A10-Unvalidated_Redirects_and_Forwards

I've added a test to ensure that the value in req.querystring.from is a relative address to the site. The test will prevent redirects to URLs in the following form;

* http://www.example.com
* https://www.example.com
* http://example.com
* https://example.com
* //www.example.com
* //example.com
* javascript:window.location.href="http://example.com"

and allow the redirects to URLs similar to the following

* /
* /my/page
* /mypage
* mypage
* ../../mypage
* ../mypage
* ?page=this

Hope this is of use?

Oliver