rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix open redirect bypass in saferedirect

Browse Source 
Relative redirect URLs are now normalized before validation. Paths
containing backslashes (including percent-encoded %5c) are rejected,
closing a bypass where /../\evil.com passed checks but http.Redirect
normalized to /\evil.com.

Reported by Fushuling and RacerZ.

Signed-off-by: Bryan Frimin <bryan@probo.com>
This commit is contained in:
Bryan Frimin
2026-05-26 11:41:33 -07:00
parent bf6fc2d509
commit 59f8e943fb
3 changed files with 89 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
SECURITY_NOTES.md
View File

@@ -3,6 +3,23 @@
User-facing notes on security-relevant changes to Probo. For the
vulnerability reporting process, see [SECURITY.md](SECURITY.md).
## Open redirect bypass in saferedirect
_2026-05-26, Auth_
Relative redirect URLs are now normalized before validation. Paths
containing backslashes (including percent-encoded `%5c`) are rejected,
and the cleaned path is checked for protocol-relative and backslash
prefixes.
Previously, `Validate` only inspected the second character of the raw
input. A path like `/../\evil.com` passed validation because the second
character is `.`, but Go's `http.Redirect` normalized it to `/\evil.com`,
which browsers can treat as an external redirect.
Reported by [Fushuling](https://github.com/Fushuling) and
[RacerZ](https://github.com/RacerZ-fighting).
## Password changes invalidate existing sessions
_2026-04-29, IAM_