Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Check that the reactions set_from_email redirect_url is legit #314

Merged
merged 4 commits into from
Jul 27, 2023
Merged

Check that the reactions set_from_email redirect_url is legit #314

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
8152b73
Check that the reactions `set_from_email` `redirect_url` is legit
issyl0 Jul 20, 2023
17ce780
Use `URI.host ==` instead of `String#starts_with?`
issyl0 Jul 24, 2023
5f7478b
Test that the redirect_url restriction works
issyl0 Jul 26, 2023
f78f3f4
Merge branch 'main' into fix-user-provided-redirect-vuln
issyl0 Jul 26, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion app/controllers/reactions_controller.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@
# GET /pathways/:course_id/notes/:lesson_id/reaction/set_from_email
def set_from_email
@reaction.update!(reaction_name: params[:reaction_name])
redirect_to redirect_url

Check warning

Code scanning / CodeQL

URL redirection from remote source Medium

Untrusted URL redirection depends on a
user-provided value
Loading
.
end

private
Expand All @@ -31,6 +31,10 @@
end

def redirect_url
params[:redirect_url].presence || course_lesson_path(@reaction.course_slug, @reaction.lesson_slug)
if params[:redirect_url].present? && URI(params[:redirect_url]).host == 'soulmedicine.io'
params[:redirect_url]
else
course_lesson_path(@reaction.course_slug, @reaction.lesson_slug)
end
end
end
13 changes: 13 additions & 0 deletions spec/requests/reactions_spec.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -157,5 +157,18 @@
expect(lesson_reaction.reaction_name).to eq reaction_name
expect(lesson_reaction.user).to eq user
end

it 'does not redirect to arbitrary websites' do
response = get set_from_email_course_lesson_reaction_url(
course_id: course.slug,
lesson_id: lesson.slug,
reaction_name: reaction_name,
user_id: user.to_sgid_param(for: :set_reaction),
redirect_to: 'https://en.wikipedia.org'
)

expect(response).to redirect_to(course_lesson_path(course.slug, lesson.slug))
expect(response).not_to redirect_to('https://en.wikipedia.org')
end
end
end
Loading