Merge pull request #58 from surevine/dwd/OF-834

OF-834: Close Open_redirect
igniterealtime · Aug 7, 2014 · a6b7d09 · a6b7d09
2 parents d0f3851 + 549dc1a
commit a6b7d09
Showing 1 changed file with 25 additions and 1 deletion.
diff --git a/src/web/login.jsp b/src/web/login.jsp
@@ -17,6 +17,8 @@
 <%@ page import="java.util.Map" %>
 <%@ page import="org.jivesoftware.util.*" %>
 <%@ page import="org.jivesoftware.admin.LoginLimitManager" %>
+<%@ page import="java.net.URL" %>
+<%@ page import="java.lang.StringBuilder" %>
 
 <%@ taglib uri="http://java.sun.com/jstl/core_rt" prefix="c" %>
 <%@ taglib uri="http://java.sun.com/jstl/fmt_rt" prefix="fmt" %>
@@ -31,7 +33,29 @@
             return "index.jsp";
         }
         else {
-            return url;
+        	if (url.startsWith("/")) {
+        		return url;
+        	}
+        	try {
+        		URL u = new URL(url);
+	        	StringBuilder s = new StringBuilder();
+	        	if (u.getPath().equals("")) {
+	        		s.append("/");
+	        	} else {
+	        		s.append(u.getPath());
+	        	}
+	        	if (u.getQuery() != null) {
+	        		s.append('?');
+	        		s.append(u.getQuery());
+	        	}
+	        	if (u.getRef() != null) {
+	        		s.append('#');
+	        		s.append(u.getRef());
+	        	}
+	            return s.toString();
+        	} catch(Exception e) {
+        		return "index.jsp";
+        	}
         }
     }
 %>