github/overleaf
1
0
Fork 0
mirror of https://github.com/overleaf/overleaf.git synced 2024-11-21 20:47:08 -05:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #2201 from overleaf/hb-relative-path-fix

Browse source 
Handle double slash case of safe redirect paths

GitOrigin-RevId: fb6e8ea9d736a65df61f07d563235262b8aaf0f3
This commit is contained in:
Simon Detheridge 2019-10-04 15:05:49 +01:00 committed by sharelatex
parent 4cce43b8d2
commit 6c005da303
2 changed files with 5 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
services/web/app/src/Features/Helpers/UrlHelper.js
View file

@ -4,7 +4,7 @@ const { URL } = require('url')
function getSafeRedirectPath(value) {
const baseURL = Settings.siteUrl // base URL is required to construct URL from path
const url = new URL(value, baseURL)
let safePath = `${url.pathname}${url.search}${url.hash}`
let safePath = `${url.pathname}${url.search}${url.hash}`.replace(/^\/+/, '/')
if (safePath === '/') {
safePath = undefined
}

4
services/web/test/unit/src/HelperFiles/UrlHelperTests.js
View file

@ -27,6 +27,10 @@ describe('UrlHelper', function() {
'/%2F%2Fevil.com'
)
expect(
this.UrlHelper.getSafeRedirectPath('http://foo.com//evil.com/bad')
).to.equal('/evil.com/bad')
return expect(this.UrlHelper.getSafeRedirectPath('.evil.com')).to.equal(
'/.evil.com'
)