mirror of
https://github.com/Sea-Haven-Industries/open-swe.git
synced 2026-10-07 16:19:09 +00:00
Adam Moussa
3daddcd14e
sanitizeAuthRedirect returned parsed.pathname+search+hash, which `new URL` can resolve to a protocol-relative `//host` (e.g. input `/..//evil.com` normalizes same-origin, passing the origin check, but yields a path starting with `//`). ClientRedirect / login.tsx feed that path to window.location.replace, so it navigates cross-origin — an open redirect. Reject any resolved path that is not a single-leading-slash path (`^/[^/]`), falling back to the default. Adds coverage for `/..//evil.com`, `/.//evil.com`, and `//evil.com`.
84 lines
2.8 KiB
TypeScript
84 lines
2.8 KiB
TypeScript
/** @vitest-environment jsdom */
|
|
|
|
import { beforeEach, describe, expect, it } from "vitest"
|
|
|
|
import { loginUrl } from "./api"
|
|
import {
|
|
AUTH_REDIRECT_STORAGE_KEY,
|
|
DEFAULT_AUTH_REDIRECT,
|
|
authRedirectPathFromLocation,
|
|
authRedirectUrl,
|
|
consumeAuthRedirect,
|
|
currentAuthRedirectPath,
|
|
getRememberedAuthRedirect,
|
|
rememberAuthRedirect,
|
|
sanitizeAuthRedirect,
|
|
} from "./auth-redirect-core"
|
|
|
|
beforeEach(() => {
|
|
window.sessionStorage.clear()
|
|
window.history.pushState({}, "", "/")
|
|
})
|
|
|
|
describe("auth redirect helpers", () => {
|
|
it("captures protected route targets as relative paths", () => {
|
|
const path = authRedirectPathFromLocation({
|
|
pathname: "/agents/thread-1/plan",
|
|
search: "?from=slack",
|
|
hash: "#review",
|
|
})
|
|
|
|
expect(path).toBe("/agents/thread-1/plan?from=slack#review")
|
|
expect(rememberAuthRedirect(path)).toBe(path)
|
|
expect(window.sessionStorage.getItem(AUTH_REDIRECT_STORAGE_KEY)).toBe(path)
|
|
})
|
|
|
|
it("resolves login targets to absolute same-origin URLs", () => {
|
|
const path = rememberAuthRedirect("/agents/thread-1/plan?from=slack#review")
|
|
|
|
const target = `${window.location.origin}/agents/thread-1/plan?from=slack#review`
|
|
|
|
expect(authRedirectUrl(path)).toBe(target)
|
|
expect(loginUrl(authRedirectUrl(path))).toContain(
|
|
encodeURIComponent(target)
|
|
)
|
|
})
|
|
|
|
it("consumes remembered targets and clears session storage", () => {
|
|
rememberAuthRedirect("/agents/thread-1/plan")
|
|
|
|
expect(consumeAuthRedirect()).toBe("/agents/thread-1/plan")
|
|
expect(getRememberedAuthRedirect()).toBeNull()
|
|
})
|
|
|
|
it("falls back for unsafe targets", () => {
|
|
expect(
|
|
sanitizeAuthRedirect("https://evil.example/agents/thread-1/plan")
|
|
).toBe(DEFAULT_AUTH_REDIRECT)
|
|
expect(sanitizeAuthRedirect("//evil.example/agents/thread-1/plan")).toBe(
|
|
DEFAULT_AUTH_REDIRECT
|
|
)
|
|
expect(sanitizeAuthRedirect("/login?redirect=/agents/thread-1/plan")).toBe(
|
|
DEFAULT_AUTH_REDIRECT
|
|
)
|
|
})
|
|
|
|
it("rejects inputs that resolve to a protocol-relative path", () => {
|
|
// These resolve same-origin (passing the origin check) but yield a `//host`
|
|
// path that would navigate cross-origin via window.location.replace.
|
|
expect(sanitizeAuthRedirect("/..//evil.com")).toBe(DEFAULT_AUTH_REDIRECT)
|
|
expect(sanitizeAuthRedirect("/.//evil.com")).toBe(DEFAULT_AUTH_REDIRECT)
|
|
expect(sanitizeAuthRedirect("//evil.com")).toBe(DEFAULT_AUTH_REDIRECT)
|
|
})
|
|
|
|
it("builds a plan sign-in target for the current plan URL", () => {
|
|
window.history.pushState({}, "", "/agents/thread-1/plan?from=slack")
|
|
|
|
expect(currentAuthRedirectPath()).toBe("/agents/thread-1/plan?from=slack")
|
|
expect(loginUrl(authRedirectUrl(currentAuthRedirectPath()))).toContain(
|
|
encodeURIComponent(
|
|
`${window.location.origin}/agents/thread-1/plan?from=slack`
|
|
)
|
|
)
|
|
})
|
|
})
|