WEBUI-1511: Own Code Static Scan : Open Redirect

nuxeo · May 31, 2024 · 6d1a13a · 6d1a13a
1 parent 17f7189
commit 6d1a13a
Show file tree

Hide file tree

Showing 2 changed files with 26 additions and 13 deletions.
diff --git a/elements/routing.js b/elements/routing.js
@@ -27,22 +27,34 @@ function scrollToTop(ctx, next) {
   next();
 }
 
-function getTrustedDomains(path) {
+function createUrlFromString(str) {
+  const httpRegex = /^https?:\/\//;
+  const wwwRegex = /www\./;
+  str = httpRegex.test(str) ? str : `http://${str}`;
+  str = wwwRegex.test(str) ? str : str.replace(/^(https?:\/\/)?/, '$1www.');
+  return str;
+}
+
+function isTrustedDomain(path) {
   const trustedDomains = Nuxeo && Nuxeo.UI && Nuxeo.UI.config && Nuxeo.UI.config.trustedDomains;
-  const pathUrl = new URL(path);
+  if (!trustedDomains) return true;
+  const modifiedPathUrl = createUrlFromString(path);
+  const pathUrl = new URL(modifiedPathUrl);
   const { hostname } = pathUrl;
-  const queryParams = pathUrl.search.split('?')[1];
-  const encodepath = queryParams ? `${pathUrl.origin}?${encodeURIComponent(queryParams)}` : path;
-  if (!trustedDomains) return { encodepath, isvalidUrl: true };
   const trustedDomainList = trustedDomains.split(',');
   const isvalidUrl = trustedDomainList.some((url) => {
-    const isFullpath = /^http(s)?:\/\//.test(url);
-    const parsedURL = isFullpath ? url : `https://${url}`;
-    const { hostname: currentUrlhost } = new URL(parsedURL);
+    const updatedUrl = createUrlFromString(url);
+    const { hostname: currentUrlhost } = new URL(updatedUrl);
     return currentUrlhost.toLowerCase() === hostname.toLowerCase();
   });
+  return isvalidUrl;
+}
 
-  return { encodepath, isvalidUrl };
+function encodeQueryParams(path) {
+  const pathUrl = new URL(path);
+  const queryParams = pathUrl.search.split('?')[1];
+  const encodepath = queryParams ? `${pathUrl.origin}?${encodeURIComponent(queryParams)}` : path;
+  return encodepath;
 }
 
 function _routeAdmin(selectedAdminTab, errorPath, routeData) {
@@ -214,7 +226,8 @@ app.router = {
     }
     const isFullpath = /^http(s)?:\/\//.test(path);
     if (isFullpath) {
-      const { encodepath, isvalidUrl } = getTrustedDomains(path);
+      const isvalidUrl = isTrustedDomain(path);
+      const encodepath = encodeQueryParams(path);
       if (isvalidUrl) {
         const link = document.createElement('a');
         link.setAttribute('href', encodepath);

diff --git a/plugin/web-ui/addon/src/main/resources/OSGI-INF/web-ui-properties.xml b/plugin/web-ui/addon/src/main/resources/OSGI-INF/web-ui-properties.xml
@@ -52,7 +52,7 @@
     <property name="org.nuxeo.web.ui.user.management.fetch.document" list="true"></property>
 
     <!-- allowed url to redirect -->
-    <property name="org.nuxeo.web.ui.trustedDomains">${nuxeo.trustedDomains}</property>
-    
+    <property name="org.nuxeo.web.ui.trustedDomains">${nuxeo.trustedDomains:=''}</property>
+
   </extension>
-</component>
+</component>