Fix HTTP Response splitting by validating URL

DSpace · Jul 27, 2020 · 294bb02 · 294bb02
1 parent cf7daef
commit 294bb02
Showing 1 changed file with 20 additions and 11 deletions.
diff --git a/dspace-api/src/main/java/org/dspace/rdf/negotiation/Negotiator.java b/dspace-api/src/main/java/org/dspace/rdf/negotiation/Negotiator.java
@@ -15,6 +15,7 @@
 import javax.servlet.http.HttpServletResponse;
 
 import org.apache.commons.lang3.StringUtils;
+import org.apache.commons.validator.routines.UrlValidator;
 import org.apache.logging.log4j.Logger;
 import org.dspace.rdf.RDFUtil;
 import org.dspace.services.factory.DSpaceServicesFactory;
@@ -197,6 +198,7 @@ public static boolean sendRedirect(HttpServletResponse response, String handle,
         if (extraPathInfo == null) {
             extraPathInfo = "";
         }
+        UrlValidator urlValidator = new UrlValidator(UrlValidator.ALLOW_LOCAL_URLS);
 
         StringBuilder urlBuilder = new StringBuilder();
         String lang = null;
@@ -256,12 +258,15 @@ public static boolean sendRedirect(HttpServletResponse response, String handle,
                 urlBuilder.append(handle).append("/").append(extraPathInfo);
             }
             String url = urlBuilder.toString();
-
-            log.debug("Will forward to '" + url + "'.");
-            response.setStatus(HttpServletResponse.SC_SEE_OTHER);
-            response.setHeader("Location", url);
-            response.flushBuffer();
-            return true;
+            if (urlValidator.isValid(url)) {
+                log.debug("Will forward to '" + url + "'.");
+                response.setStatus(HttpServletResponse.SC_SEE_OTHER);
+                response.setHeader("Location", url);
+                response.flushBuffer();
+                return true;
+            } else {
+                throw new IOException("Invalid URL '" + url + "', cannot redirect.");
+            }
         }
 
         // currently we cannot serve statistics as rdf
@@ -287,10 +292,14 @@ public static boolean sendRedirect(HttpServletResponse response, String handle,
         urlBuilder.append("/handle/").append(handle);
         urlBuilder.append("/").append(lang);
         String url = urlBuilder.toString();
-        log.debug("Will forward to '" + url + "'.");
-        response.setStatus(HttpServletResponse.SC_SEE_OTHER);
-        response.setHeader("Location", url);
-        response.flushBuffer();
-        return true;
+        if (urlValidator.isValid(url)) {
+            log.debug("Will forward to '" + url + "'.");
+            response.setStatus(HttpServletResponse.SC_SEE_OTHER);
+            response.setHeader("Location", url);
+            response.flushBuffer();
+            return true;
+        } else {
+            throw new IOException("Invalid URL '" + url + "', cannot redirect.");
+        }
     }
 }