Login redirect doesn't verify redirect is local - Githubissues

openbmc / phosphor-webui

Web-based user interface for managing OpenBMC systems

Apache License 2.0

37 stars 25 forks source link

Login redirect doesn't verify redirect is local #109

Closed feistjj closed 4 years ago

feistjj commented 4 years ago

https://github.com/openbmc/phosphor-webui/blob/c652ed1889599da3ca2a0e0d36979e099f9b3b8c/app/login/controllers/login-controller.js#L46

This can be used to redirect a user anywhere given a bad link, should check first that redirect is local to current host.

gtmills commented 4 years ago

Resolved by https://gerrit.openbmc-project.xyz/c/openbmc/phosphor-webui/+/29216