GlcoinCore/specter-desktop
1
0
Fork 0
mirror of https://github.com/cryptoadvance/specter-desktop.git synced 2026-08-13 12:33:29 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 8

Security: Fix login open redirect due to next parameter manipulation (#2350)

Browse source 
* fix login  open redirect due to next parameter manipulation
This commit is contained in:
zealsham 2023-07-07 05:31:54 -07:00 • committed by GitHub
parent 9261245faf
commit 8f9c95fe1b
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 9 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
src/cryptoadvance/specter/helpers.py
View file

@ -345,3 +345,7 @@ def get_address_from_dict(data_dict):
if addr and addr != "Fee":
return addr
raise RuntimeError(f"Missing address info in object {data_dict}")
def is_relative_url(url):
return re.match(r"^\/[^\/\\]", url)

7
src/cryptoadvance/specter/server_endpoints/auth.py
View file

@ -1,6 +1,7 @@
import random
import time
from flask import Blueprint, Flask
from flask import current_app as app
from flask import jsonify, redirect, render_template, request, url_for
@ -9,7 +10,7 @@ from flask_login import current_user, login_required, logout_user
from cryptoadvance.specter.specter import Specter
from ..helpers import alias
from ..helpers import alias, is_relative_url
from ..server_endpoints import flash
from ..services import ExtensionException
from ..user import User, hash_password, verify_password
@ -235,7 +236,9 @@ def redirect_login(request):
if app.specter.hide_sensitive_info:
app.specter.update_hide_sensitive_info(False, current_user)
if request.form.get("next") and request.form.get("next") != "None":
if (
request.form.get("next") and request.form.get("next") != "None"
) and is_relative_url(request.form["next"]):
response = redirect(request.form["next"])
else:
response = redirect(url_for("index"))