[SECURITY-684] Fix Open redirect vulnerability

jenkinsci · Apr 12, 2018 · bf3a0ba · bf3a0ba
1 parent d8d673f
commit bf3a0ba
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/src/main/java/org/jenkinsci/plugins/googlelogin/GoogleOAuth2SecurityRealm.java b/src/main/java/org/jenkinsci/plugins/googlelogin/GoogleOAuth2SecurityRealm.java
@@ -159,9 +159,9 @@ protected String getPostLogOutUrl(StaplerRequest req, Authentication auth) {
      */
     public HttpResponse doCommenceLogin(@QueryParameter String from,  @Header("Referer") final String referer) throws IOException {
         final String redirectOnFinish;
-        if (from != null) {
+        if (from != null && ! Util.isAbsoluteUri(from) && ! from.startsWith("//")) {
             redirectOnFinish = from;
-        } else if (referer != null) {
+        } else if (referer != null && ! Util.isAbsoluteUri(referer) && ! referer.startsWith("//")) {
             redirectOnFinish = referer;
         } else {
             redirectOnFinish = Jenkins.getInstance().getRootUrl();