Skip to content

Commit

Permalink
Prevent open redirect by appending a trailing slash (#5532)
Browse files Browse the repository at this point in the history
Motivation:
The absence of a trailing slash on the `redirectUrl` host of BaseLayout
exposes the system to Open Redirect vulnerabilities when the matched
value of the regex is altered.

Modifications:
- Added logic to append a trailing slash to the `redirectUrl` host.

Result:
- Open redirect vulnerabilities are mitigated on armeria.dev site.
  • Loading branch information
minwoox authored Mar 27, 2024
1 parent fadd348 commit 7f30250
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion site/src/layouts/base.tsx
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@ const BaseLayout: React.FC<BaseLayoutProps> = (props) => {
);
let redirectUrl;
if (hrefMatches && hrefMatches.length === 2) {
redirectUrl = `https://armeria.dev${hrefMatches[1]}`;
redirectUrl = `https://armeria.dev/${hrefMatches[1]}`;
globalHistory.navigate(redirectUrl);
}
// Do not index redirect pages.
Expand Down

0 comments on commit 7f30250

Please sign in to comment.