From 8ed6f1824f844dbe3ece64aebaaab8e80d750438 Mon Sep 17 00:00:00 2001 From: Sacha Al Himdani Date: Thu, 19 Mar 2026 14:54:53 +0100 Subject: [PATCH] Fix unvalidated URL redirection in HTTP redirects Use baseurl.Parse to construct the HTTPS redirect URL in the trust center HTTP handler, breaking the taint chain from raw request headers. Apply path.Clean to the slug-based redirect in stripTrustPrefix to normalize path traversal sequences. Addresses CodeQL go/unvalidated-url-redirection (CWE-601). Signed-off-by: Sacha Al Himdani --- pkg/probod/probod.go | 8 +++++++- pkg/server/server.go | 4 +++- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/pkg/probod/probod.go b/pkg/probod/probod.go index f51e5f609..9bc066a36 100644 --- a/pkg/probod/probod.go +++ b/pkg/probod/probod.go @@ -767,7 +767,13 @@ func newTrustCenterHTTPRedirectHandler(proboService *probo.Service, l *log.Logge } // This is a trust center domain, redirect to HTTPS - httpsURL := "https://" + r.Host + r.URL.RequestURI() + base, err := baseurl.Parse("https://" + domain) + if err != nil { + httpserver.RenderError(w, http.StatusNotFound, errors.New("not found")) + return + } + + httpsURL := base.WithPath(r.URL.Path).WithQueryValues(r.URL.Query()).MustString() l.InfoCtx( ctx, "HTTP request to trust center custom domain, redirecting to HTTPS", diff --git a/pkg/server/server.go b/pkg/server/server.go index 2c6e55a51..ed14cab44 100644 --- a/pkg/server/server.go +++ b/pkg/server/server.go @@ -17,6 +17,7 @@ package server import ( "errors" "net/http" + "path" "strings" "github.com/go-chi/chi/v5" @@ -156,7 +157,8 @@ func (s *Server) stripTrustPrefix(next http.Handler) http.Handler { prefix := "/trust/" + slugOrId if r.URL.Path == prefix { - http.Redirect(w, r, prefix+"/", http.StatusMovedPermanently) + cleanPath := path.Clean(prefix) + "/" + http.Redirect(w, r, cleanPath, http.StatusMovedPermanently) return }