Fix #3073, validate URLs before redirect (#3074)

mozilla-services · Jul 11, 2017 · ecfaa64 · ecfaa64
1 parent 36c6502
commit ecfaa64
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/server/src/server.js b/server/src/server.js
@@ -462,6 +462,11 @@ app.post("/timing", function(req, res) {
 
 app.get("/redirect", function(req, res) {
   if (req.query.to) {
+    if (!validUrl.isWebUri(req.query.to)) {
+      mozlog.warn("redirect-to-bad-url", {msg: "?to is not a proper URL", url: req.query.to});
+      res.status(400).send("Bad ?to parameter");
+      return;
+    }
     let from = req.query.from;
     if (!from) {
       from = "shot-detail";