Bryan Frimin 59f8e943fb Fix open redirect bypass in saferedirect ...

Relative redirect URLs are now normalized before validation. Paths
containing backslashes (including percent-encoded %5c) are rejected,
closing a bypass where /../\evil.com passed checks but http.Redirect
normalized to /\evil.com.

Reported by Fushuling and RacerZ.

Signed-off-by: Bryan Frimin <bryan@probo.com>

2026-05-26 11:41:33 -07:00

..

accessreview

Fix wsl_v5 lint errors and exclude node_modules from linting

2026-05-20 15:05:08 +04:00

agent

Enforce Go style rules across codebase

2026-05-20 11:46:39 +04:00

agentruntest

Add wsl linter and fix

2026-05-20 09:27:28 +04:00

awsconfig

Enforce Go style rules across codebase

2026-05-20 11:46:39 +04:00

baseurl

Add wsl linter and fix

2026-05-20 09:27:28 +04:00

bearertoken

Update copyright headers across all Go files

2026-03-25 17:38:32 +01:00

bootstrap

Enforce Go style rules across codebase

2026-05-20 11:46:39 +04:00

certmanager

Enforce Go style rules across codebase

2026-05-20 11:46:39 +04:00

cli

Enforce Go style rules across codebase

2026-05-20 11:46:39 +04:00

cmd

Allow initial document minor publishing

2026-05-26 08:26:47 -07:00

connector

Add wsl linter and fix

2026-05-20 09:27:28 +04:00

cookiebanner

Fold PromoteSource into Update

2026-05-26 18:06:55 +02:00

coredata

Fold PromoteSource into Update

2026-05-26 18:06:55 +02:00

crypto

Add wsl linter and fix

2026-05-20 09:27:28 +04:00

docgen

Add wsl linter and fix

2026-05-20 09:27:28 +04:00

esign

Tailor signature certificate email copy for approvals

2026-05-21 14:49:19 +02:00

evidencedescriber

Add wsl linter and fix

2026-05-20 09:27:28 +04:00

file

Upgrade to kit v0.3.0

2026-04-03 11:56:06 +02:00

filemanager

Add wsl linter and fix

2026-05-20 09:27:28 +04:00

filevalidation

Add wsl linter and fix

2026-05-20 09:27:28 +04:00

geoloc

Uniformize enum style

2026-05-20 15:36:47 -07:00

gid

Add wsl linter and fix

2026-05-20 09:27:28 +04:00

html2pdf

Add wsl linter and fix

2026-05-20 09:27:28 +04:00

iam

Fix timing attack on signin

2026-05-25 23:04:44 -07:00

llm

Enforce Go style rules across codebase

2026-05-20 11:46:39 +04:00

mail

Add wsl linter and fix

2026-05-20 09:27:28 +04:00

mailer

Add wsl linter and fix

2026-05-20 09:27:28 +04:00

mailman

Remove useless error checks

2026-05-20 09:53:09 +04:00

net

Add wsl linter and fix

2026-05-20 09:27:28 +04:00

page

Add wsl linter and fix

2026-05-20 09:27:28 +04:00

pdfutils

Add wsl linter and fix

2026-05-20 09:27:28 +04:00

probo

Remove obsolete minor publish error

2026-05-26 08:26:49 -07:00

proboctl

Uniformize enum style

2026-05-20 15:36:47 -07:00

probod

Fix indentation after errors.AsType refactor

2026-05-20 11:53:50 +04:00

probodconfig

Add wsl linter and fix

2026-05-20 09:27:28 +04:00

prosemirror

Enforce Go style rules across codebase

2026-05-20 11:46:39 +04:00

rfc5988

Add wsl linter and fix

2026-05-20 09:27:28 +04:00

riskmanagement

Fix wsl_v5 lint errors and exclude node_modules from linting

2026-05-20 15:05:08 +04:00

saferedirect

Fix open redirect bypass in saferedirect

2026-05-26 11:41:33 -07:00

securecookie

Add wsl linter and fix

2026-05-20 09:27:28 +04:00

securetoken

Fix non-constant-time string != comparison

2026-04-20 09:46:44 +02:00

server

Remove obsolete minor publish error

2026-05-26 08:26:49 -07:00

slack

Remove tenant service pattern

2026-05-20 16:51:15 -07:00

slug

Update copyright headers across all Go files

2026-03-25 17:38:32 +01:00

statelesstoken

Fix non-constant-time string != comparison

2026-04-20 09:46:44 +02:00

thirdparty

Self-host common third party logos via S3

2026-05-12 16:43:36 +04:00

trust

Link measures to third parties

2026-05-26 15:49:17 +02:00

uri

Add wsl linter and fix

2026-05-20 09:27:28 +04:00

validator

Add wsl linter and fix

2026-05-20 09:27:28 +04:00

version

Add wsl linter and fix

2026-05-20 09:27:28 +04:00

vetting

Add wsl linter and fix

2026-05-20 09:27:28 +04:00

webhook

Enforce Go style rules across codebase

2026-05-20 11:46:39 +04:00