Fix #3073, validate URLs before redirect

mozilla-services · Jun 30, 2017 · 16d1213 · 16d1213
1 parent beac583
commit 16d1213
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/server/src/server.js b/server/src/server.js
@@ -462,6 +462,11 @@ app.post("/timing", function(req, res) {
 
 app.get("/redirect", function(req, res) {
   if (req.query.to) {
+    if (! validUrl.isWebUri(req.query.to)) {
+      mozlog.warn("redirect-to-bad-url", {msg: "?to is not a proper URL", url: req.query.to});
+      res.status(400).send("Bad ?to parameter");
+      return;
+    }
     let from = req.query.from;
     if (!from) {
       from = "shot-detail";