Fix open redirect using //

Signed-off-by: Bryan Frimin <bryan@getprobo.com>
2025-04-30 18:58:14 -07:00
parent 7772229b71
commit 4d7ec24042
2 changed files with 65 additions and 4 deletions
--- a/pkg/saferedirect/saferedirect.go
+++ b/pkg/saferedirect/saferedirect.go
@@ -32,6 +32,9 @@ func (sr *SafeRedirect) Validate(redirectURL string) (string, bool) {
 	}

 	if strings.HasPrefix(redirectURL, "/") {
+		if len(redirectURL) > 1 && (redirectURL[1] == '/' || redirectURL[1] == '\\') {
+			return "", false
+		}
 		return redirectURL, true
 	}