Web Parameter Tampering on /login?errorMsg

[MauroEldritch]

What kind of request is this (question/bug/enhancement/feature request): Enhancement

Steps to reproduce (least amount of steps as possible):

• Access the following endpoint on any Rancher instance up to 2.1.4: https://RANCHER:PORT

/login?errorMsg=%68%74%74%70%73%3a%2f%2f%77%77%77%2e%6f%77%61%73%70%2e%6f%72%67%2f%69%6e%64%65%78%2e%70%68%70%2f%57%65%62%5f%50%61%72%61%6d%65%74%65%72%5f%54%61%6d%70%65%72%69%6e%67

Result: It will display a link to OWASP Wiki explaining Web Parameter Tampering.

Other details that may be helpful: Tags are effectively filtered.

Environment information

• Rancher version (rancher/rancher/rancher/server image tag or shown bottom left in the UI): 2.1.4
• Installation option (single install/HA): *

Cluster information

• Cluster type (Hosted/Infrastructure Provider/Custom/Imported):
• Machine type (cloud/VM/metal) and specifications (CPU/memory):
• Kubernetes version (use kubectl version):

N/A

• Docker version (use docker version): *

N/A

[alena1108]

Based on @vincent99 input, the fix will be a combination of UI and the backend. There's one place the backend sends it that would need to be updated;

rancher/pkg/auth/providers/saml/saml_client.go

Line 279 in f966203

http.Redirect(w, r, redirectURL+"errorCode=422&errorMsg=Invalid saml attributes", http.StatusFound)

[davidnuzik]

I validated the UI aspect of the fix.

Replication:
v2.2.3

• Provision rancher, follow prompts to create password, set server url. Log out.
• Go to https://RANCHERSERVER/login?errorMsg=%68%74%74%70%73%3a%2f%2f%77%77%77%2e%6f%77%61%73%70%2e%6f%72%67%2f%69%6e%64%65%78%2e%70%68%70%2f%57%65%62%5f%50%61%72%61%6d%65%74%65%72%5f%54%61%6d%70%65%72%69%6e%67
  Error shows link to the OWASP article (not an href/clickable hyperlink)
  
• Any arbitrary content is possible such as /login?errorMsg=tacos%20rule
  
• HTML/etc is not rendered
  /login?errorMsg=%3C!DOCTYPE%20html%3E%3Chtml%3E%3Cbody%3E%3Csvg%20width%3D%22100%22%20height%3D%22100%22%3E%3Ccircle%20cx%3D%2250%22%20cy%3D%2250%22%20r%3D%2240%22%20stroke%3D%22green%22%20stroke-width%3D%224%22%20fill%3D%22yellow%22%20%2F%3E%3C%2Fsvg%3E%3C%2Fbody%3E%3C%2Fhtml%3E
  

Validation:
v2.2.4-rc8

I tried the same again to validate. For all cases I only get the generic login error message: