From d9474b7e58b046201861868cc5ade5ce9d11f497 Mon Sep 17 00:00:00 2001 From: Carl Schwan Date: Wed, 27 May 2026 16:19:29 +0200 Subject: [PATCH] fix: harden redirecting after login Ensure path are always correct or redirect to the root of the website Signed-off-by: Carl Schwan --- lib/Controller/LoginController.php | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/lib/Controller/LoginController.php b/lib/Controller/LoginController.php index 097cf9e1..5a600493 100644 --- a/lib/Controller/LoginController.php +++ b/lib/Controller/LoginController.php @@ -142,16 +142,20 @@ private function buildProtocolErrorResponse(?bool $throttle = null): TemplateRes * @return RedirectResponse */ private function getRedirectResponse(?string $redirectUrl = null): RedirectResponse { + $baseUrl = $this->urlGenerator->getBaseUrl(); + if ($redirectUrl === null) { - return new RedirectResponse($this->urlGenerator->getBaseUrl()); + return new RedirectResponse($baseUrl); } // Remove protocol and domain name $filtered = preg_replace('/^https?:\/\/[^\/]+/', '', $redirectUrl) ?? ''; - // Additional check: ensure the result starts with a single / - if (!preg_match('/^\/[^\/]/', $filtered)) { - return new RedirectResponse($this->urlGenerator->getBaseUrl()); + // Reject protocol-relative URLs and anything not starting with a single slash followed + // by an alphanumeric or one of [_-.~?#] + if (!preg_match('/^\/[A-Za-z0-9_\-.~?#]/', $filtered)) { + $this->logger->error("Rejected invalid redirect url '{$filtered}'"); + return new RedirectResponse($baseUrl); } return new RedirectResponse($filtered);