diff options
| author | Wim <wim@42.be> | 2021-03-20 22:40:23 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-03-20 22:40:23 +0100 |
| commit | ee5d9b43b54a3becf3cb4025198f24608d35500d (patch) | |
| tree | dd3614db7423da52f5a71da3001e48d1e4195ea1 /vendor/github.com/labstack/echo/v4/middleware/slash.go | |
| parent | 3a8857c8c9efb2c67fb8c175f31d2b9c617b771b (diff) | |
| download | matterbridge-msglm-ee5d9b43b54a3becf3cb4025198f24608d35500d.tar.gz matterbridge-msglm-ee5d9b43b54a3becf3cb4025198f24608d35500d.tar.bz2 matterbridge-msglm-ee5d9b43b54a3becf3cb4025198f24608d35500d.zip | |
Update vendor (#1414)
Diffstat (limited to 'vendor/github.com/labstack/echo/v4/middleware/slash.go')
| -rw-r--r-- | vendor/github.com/labstack/echo/v4/middleware/slash.go | 13 |
1 files changed, 11 insertions, 2 deletions
diff --git a/vendor/github.com/labstack/echo/v4/middleware/slash.go b/vendor/github.com/labstack/echo/v4/middleware/slash.go index 0492b334..4188675b 100644 --- a/vendor/github.com/labstack/echo/v4/middleware/slash.go +++ b/vendor/github.com/labstack/echo/v4/middleware/slash.go @@ -60,7 +60,7 @@ func AddTrailingSlashWithConfig(config TrailingSlashConfig) echo.MiddlewareFunc // Redirect if config.RedirectCode != 0 { - return c.Redirect(config.RedirectCode, uri) + return c.Redirect(config.RedirectCode, sanitizeURI(uri)) } // Forward @@ -108,7 +108,7 @@ func RemoveTrailingSlashWithConfig(config TrailingSlashConfig) echo.MiddlewareFu // Redirect if config.RedirectCode != 0 { - return c.Redirect(config.RedirectCode, uri) + return c.Redirect(config.RedirectCode, sanitizeURI(uri)) } // Forward @@ -119,3 +119,12 @@ func RemoveTrailingSlashWithConfig(config TrailingSlashConfig) echo.MiddlewareFu } } } + +func sanitizeURI(uri string) string { + // double slash `\\`, `//` or even `\/` is absolute uri for browsers and by redirecting request to that uri + // we are vulnerable to open redirect attack. so replace all slashes from the beginning with single slash + if len(uri) > 1 && (uri[0] == '\\' || uri[0] == '/') && (uri[1] == '\\' || uri[1] == '/') { + uri = "/" + strings.TrimLeft(uri, `/\`) + } + return uri +} |