Blame · Line-by-line history
safe-redirect.ts
Each line is annotated with the commit that last touched it. Click any SHA to jump to that commit and see the surrounding change.
| e9a4574 | 1 | /** |
| 2 | * Same-origin validation for user-supplied redirect targets. | |
| 3 | * | |
| 4 | * Every `?redirect=` sink in the auth flow used to pass the query value | |
| 5 | * straight to `c.redirect()`. `/login?redirect=https://evil.example` sent the | |
| 6 | * browser to the attacker's site carrying the platform's own domain in the | |
| 7 | * link the victim clicked — the classic phishing primitive, and worse on a | |
| 8 | * sign-in page than anywhere else, because the victim has just been asked to | |
| 9 | * type a password and the attacker controls where they land immediately | |
| 10 | * after. It also lets an attacker bounce a freshly-authenticated user to a | |
| 11 | * page that harvests whatever the app puts in the URL. | |
| 12 | * | |
| 13 | * The policy here is deliberately narrow: accept a relative path on this | |
| 14 | * origin, reject everything else. Absolute URLs are refused even when they | |
| 15 | * point at our own host — allowing them means parsing and comparing origins, | |
| 16 | * and origin comparison is exactly where these bugs come from. | |
| 17 | * | |
| 18 | * Rejected, with the reason each one matters: | |
| 19 | * | |
| 20 | * https://evil.example absolute URL, different origin | |
| 21 | * //evil.example protocol-relative; browsers treat it as absolute | |
| 22 | * /\evil.example browsers fold a backslash to a slash, so this | |
| 23 | * behaves like the protocol-relative case above | |
| 24 | * javascript:alert(1) scheme URL, no leading slash | |
| 25 | * /foo\r\nSet-Cookie: x control characters, i.e. header injection | |
| 26 | * (empty / missing) nothing to honour | |
| 27 | * | |
| 28 | * Accepted: `/dashboard`, `/owner/repo/pulls?state=open#tab`, `/` — a single | |
| 29 | * leading slash, no backslash anywhere, no control characters. | |
| 30 | * | |
| 31 | * Note on encoding: Hono has already percent-decoded the query value by the | |
| 32 | * time it reaches here, so `%2f%2fevil.example` arrives as `//evil.example` | |
| 33 | * and `%0d%0a` arrives as real control characters. Both are caught above. | |
| 34 | * Validate the decoded value — never the raw one. | |
| 35 | */ | |
| 36 | ||
| 37 | /** | |
| 38 | * A single leading slash, not followed by another slash, then any run of | |
| 39 | * characters that are neither backslashes nor C0/C1 control characters. | |
| 40 | */ | |
| 41 | const SAFE_PATH = /^\/(?!\/)[^\\\x00-\x1f\x7f-\x9f]*$/; | |
| 42 | ||
| 43 | /** True if `value` is a relative path safe to redirect to on this origin. */ | |
| 44 | export function isSafeRedirect(value: unknown): value is string { | |
| 45 | if (typeof value !== "string") return false; | |
| 46 | if (value.length === 0) return false; | |
| 47 | return SAFE_PATH.test(value); | |
| 48 | } | |
| 49 | ||
| 50 | /** | |
| 51 | * Return `value` when it is a safe same-origin path, otherwise `fallback`. | |
| 52 | * | |
| 53 | * Always use this — never the raw query value — when building a `Location` | |
| 54 | * header from anything the caller supplied. | |
| 55 | */ | |
| 56 | export function safeRedirect(value: unknown, fallback: string = "/"): string { | |
| 57 | return isSafeRedirect(value) ? value : fallback; | |
| 58 | } |