net/url: malformed urls may lead to an "open redirect" vulnerability #38642
Description
What version of Go are you using (go version)?
$ go version go version go1.14.1 linux/amd64
Does this issue reproduce with the latest release?
Yes
What operating system and processor architecture are you using (go env)?
go env Output
$ go env GOHOSTARCH="amd64" GOHOSTOS="linux" GOARCH="amd64"
What did you do?
package main
import (
"fmt"
"net/url"
)
func main() {
u,err := url.Parse("https:///www.google.com")
if err != nil{
fmt.Println(err)
}
fmt.Printf("Host:%s\nPath:%s",u.Host,u.Path)
}What did you expect to see?
An error
What did you see instead?
Host:
Path: /www.google.com
What harm does it have？
This illegal url will lead to unexpected results when the server responses with 301/302/30x statuses, for our browsers will be very likely to fix it to a normal one. That results in an open redirect vulnerability, as the backend treats it like a relative-path jump while the browser treat it as a redirection to other sites.
How to fix?
Check url's Scheme and Host as below:
if (u.Scheme == "http" || u.Scheme == "https" ) && u.Host == ""{
return errors.New("wrong url")
}