rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Pin Okta pagination to the same https origin

Browse Source 
The rel="next" link is taken from the provider response, so the host
check alone let a response downgrade the next request to http or move
it to another port on the same host. Reject a non-https scheme and any
explicit port in addition to a host mismatch, so the crawl stays on
the same https origin.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
This commit is contained in:
Aurélien Sibiril
2026-06-04 18:29:11 +02:00
parent 44c3d3fd9d
commit d3e8845fac
1 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
pkg/accessreview/drivers/okta.go
View File

@@ -178,8 +178,11 @@ func (d *OktaDriver) nextPageURL(linkHeader string) (string, error) {
return "", fmt.Errorf("cannot parse okta next-page link")
}
if !strings.EqualFold(u.Hostname(), d.domain) {
return "", fmt.Errorf("cannot follow okta next-page link: host mismatch")
// Pin the next page to the same https origin: reject a scheme downgrade
// (http), an explicit port, or a different host so a provider response
// cannot redirect the crawl off-TLS, to another port, or off-tenant.
if !strings.EqualFold(u.Scheme, "https") || u.Port() != "" || !strings.EqualFold(u.Hostname(), d.domain) {
return "", fmt.Errorf("cannot follow okta next-page link: invalid target")
}
return u.String(), nil