Skip to content

Commit 512e87e

Browse files
lkotuladahlerlend
lkotula
authored and
dahlerlend
committed
Bug#37697546 - Reliable URL Redirection
Description =========== The authentication redirection parameter, when used must be validated against: "URL Handling Best Practices". For example: * host part contains control characters * double slashes after host * "@" to inject fake domains after it * double slashes without protocol * unknown protocol (allow only http, https) * no protocol selected * path part contains control characters * relative path, directory traversing Fix === Implemented additional checks, mentioned inside the description. (POST-PUSH FIX WL#15440) Change-Id: I234b8ed1ca03136734de063fa8b6b8440f2ea55f
1 parent 3fffaed commit 512e87e

File tree

9 files changed

+568
-36
lines changed

9 files changed

+568
-36
lines changed

‎mysql-test/suite/router/include/test/authentication_redirect.inc

Lines changed: 193 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,193 @@
1+
if ($test_idx_val)
2+
{
3+
--inc $test_idx_val
4+
}
5+
6+
if (!$test_idx_val)
7+
{
8+
--let $test_idx_val=1
9+
}
10+
11+
if ($test_idx_val == 1)
12+
{
13+
--let $test_idx=I
14+
}
15+
16+
if ($test_idx_val == 2)
17+
{
18+
--let $test_idx=II
19+
}
20+
21+
--echo
22+
--echo #
23+
--echo # $test_idx.1
24+
25+
exec $MRS_CLIENT_ARGS
26+
-a BASIC
27+
--path /$test_service/authentication/login
28+
-u mrsuser -p S3kre7;
29+
30+
exec $MRS_CLIENT_ARGS
31+
-a BASIC
32+
--expected-status Unauthorized
33+
--path /$test_service/authentication/login?onCompletionRedirect=https://www.evil.ev%0Aservice.local/something/1
34+
-u mrsuser -p S3kre7;
35+
36+
exec $MRS_CLIENT_ARGS
37+
-a BASIC
38+
--expected-status Unauthorized
39+
--path /$test_service/authentication/login?onCompletionRedirect=https://www.evil.ev%0Ahttps://www.service.local/something/1
40+
-u mrsuser -p S3kre7;
41+
42+
exec $MRS_CLIENT_ARGS
43+
-a BASIC
44+
--expected-status Unauthorized
45+
--path /$test_service/authentication/login?onCompletionRedirect=https://www.evil.ev%09service.local/something/1
46+
-u mrsuser -p S3kre7;
47+
48+
exec $MRS_CLIENT_ARGS
49+
-a BASIC
50+
--expected-status Unauthorized
51+
--path /$test_service/authentication/login?onCompletionRedirect=https://www.evil.ev%09https://www.service.local/something/1
52+
-u mrsuser -p S3kre7;
53+
54+
exec $MRS_CLIENT_ARGS
55+
-a BASIC
56+
--expected-status Unauthorized
57+
--path /$test_service/authentication/login?onCompletionRedirect=https://www.evil.ev%0Bservice.local/something/1
58+
-u mrsuser -p S3kre7;
59+
60+
exec $MRS_CLIENT_ARGS
61+
-a BASIC
62+
--expected-status Unauthorized
63+
--path /$test_service/authentication/login?onCompletionRedirect=https://www.evil.ev%0Bhttps://www.service.local/something/1
64+
-u mrsuser -p S3kre7;
65+
66+
exec $MRS_CLIENT_ARGS
67+
-a BASIC
68+
--expected-status Unauthorized
69+
--path /$test_service/authentication/login?onCompletionRedirect=https://a%20.pl//www.something.ev
70+
-u mrsuser -p S3kre7;
71+
72+
exec $MRS_CLIENT_ARGS
73+
-a BASIC
74+
--expected-status Unauthorized
75+
--path /$test_service/authentication/login?onCompletionRedirect=a%00.pl//www.evil.ev
76+
-u mrsuser -p S3kre7;
77+
78+
exec $MRS_CLIENT_ARGS
79+
-a BASIC
80+
--expected-status Unauthorized
81+
--path /$test_service/authentication/login?onCompletionRedirect=https://a%00.pl//www.evil.ev
82+
-u mrsuser -p S3kre7;
83+
84+
85+
--echo
86+
--echo #
87+
--echo # $test_idx.2
88+
exec $MRS_CLIENT_ARGS
89+
-a BASIC
90+
--expected-status Unauthorized
91+
--path /$test_service/authentication/login?onCompletionRedirect=https://www.evil.ev//https://www.service.local/something/1
92+
-u mrsuser -p S3kre7;
93+
94+
exec $MRS_CLIENT_ARGS
95+
-a BASIC
96+
--expected-status Unauthorized
97+
--path /$test_service/authentication/login?onCompletionRedirect=https://www.evil.ev/x//something/1
98+
-u mrsuser -p S3kre7;
99+
100+
exec $MRS_CLIENT_ARGS
101+
-a BASIC
102+
--expected-status Unauthorized
103+
--path /$test_service/authentication/login?onCompletionRedirect=https://www.evil.ev/x//
104+
-u mrsuser -p S3kre7;
105+
106+
exec $MRS_CLIENT_ARGS
107+
-a BASIC
108+
--expected-status Unauthorized
109+
--path /$test_service/authentication/login?onCompletionRedirect=https://www.evil.ev//something/1
110+
-u mrsuser -p S3kre7;
111+
112+
--echo
113+
--echo #
114+
--echo # $test_idx.3
115+
exec $MRS_CLIENT_ARGS
116+
-a BASIC
117+
--expected-status Unauthorized
118+
--path /$test_service/authentication/login?onCompletionRedirect=https://www.service.local/something/1@https://www.evil.ev
119+
-u mrsuser -p S3kre7;
120+
121+
exec $MRS_CLIENT_ARGS
122+
-a BASIC
123+
--expected-status Unauthorized
124+
--path /$test_service/authentication/login?onCompletionRedirect=https://www.service.local@https://www.evil.ev/something
125+
-u mrsuser -p S3kre7;
126+
127+
128+
--echo
129+
--echo #
130+
--echo # $test_idx.4
131+
exec $MRS_CLIENT_ARGS
132+
-a BASIC
133+
--expected-status Unauthorized
134+
--path /$test_service/authentication/login?onCompletionRedirect=//www.evil.ev
135+
-u mrsuser -p S3kre7;
136+
137+
138+
--echo
139+
--echo #
140+
--echo # $test_idx.5
141+
exec $MRS_CLIENT_ARGS
142+
-a BASIC
143+
--expected-status Unauthorized
144+
--path /$test_service/authentication/login?onCompletionRedirect=%20//www.evil.ev
145+
-u mrsuser -p S3kre7;
146+
147+
exec $MRS_CLIENT_ARGS
148+
-a BASIC
149+
--expected-status Unauthorized
150+
--path /$test_service/authentication/login?onCompletionRedirect=a%20.pl//www.evil.ev
151+
-u mrsuser -p S3kre7;
152+
153+
exec $MRS_CLIENT_ARGS
154+
-a BASIC
155+
--expected-status Unauthorized
156+
--path /$test_service/authentication/login?onCompletionRedirect=a.pl://www.evil.ev
157+
-u mrsuser -p S3kre7;
158+
159+
exec $MRS_CLIENT_ARGS
160+
-a BASIC
161+
--expected-status Unauthorized
162+
--path /$test_service/authentication/login?onCompletionRedirect=mysql://www.evil.ev
163+
-u mrsuser -p S3kre7;
164+
165+
166+
--echo
167+
--echo #
168+
--echo # $test_idx.6
169+
exec $MRS_CLIENT_ARGS
170+
-a BASIC
171+
--expected-status Unauthorized
172+
--path /$test_service/authentication/login?onCompletionRedirect=www.host_without_scheme.com
173+
-u mrsuser -p S3kre7;
174+
175+
176+
--echo
177+
--echo #
178+
--echo # $test_idx.7
179+
exec $MRS_CLIENT_ARGS
180+
-a BASIC
181+
--expected-status Unauthorized
182+
--path /$test_service/authentication/login?onCompletionRedirect=https://www.host_without_scheme.com/path%0Asomething/1
183+
-u mrsuser -p S3kre7;
184+
185+
186+
--echo
187+
--echo #
188+
--echo # $test_idx.8
189+
exec $MRS_CLIENT_ARGS
190+
-a BASIC
191+
--expected-status Unauthorized
192+
--path /$test_service/authentication/login?onCompletionRedirect=../../admin
193+
-u mrsuser -p S3kre7;

0 commit comments

Comments
 (0)