WEBUI-1511: Own Code Static Scan : Open Redirect

nuxeo · May 27, 2024 · 982992e · 982992e
1 parent 38cf581
commit 982992e
Show file tree

Hide file tree

Showing 2 changed files with 29 additions and 4 deletions.
diff --git a/elements/routing.js b/elements/routing.js
@@ -27,6 +27,24 @@ function scrollToTop(ctx, next) {
   next();
 }
 
+function getTrustedDomains(path) {
+  const trustedDomains = Nuxeo && Nuxeo.UI && Nuxeo.UI.config && Nuxeo.UI.config.trustedDomains;
+  const pathUrl = new URL(path);
+  const { hostname } = pathUrl;
+  const queryParams = pathUrl.search.split('?')[1];
+  const encodepath = queryParams ? `${pathUrl.origin}?${encodeURIComponent(queryParams)}` : path;
+  if (!trustedDomains) return { encodepath, isvalidUrl: true };
+  const trustedDomainList = trustedDomains.split(',');
+  const isvalidUrl = trustedDomainList.some((url) => {
+    const isFullpath = /^http(s)?:\/\//.test(url);
+    const parsedURL = isFullpath ? url : `https://${url}`;
+    const { hostname: currentUrlhost } = new URL(parsedURL);
+    return currentUrlhost.toLowerCase() === hostname.toLowerCase();
+  });
+
+  return { encodepath, isvalidUrl };
+}
+
 function _routeAdmin(selectedAdminTab, errorPath, routeData) {
   const hasPermission =
     app.currentUser.isAdministrator || app.currentUser.extendedGroups.find((grp) => grp.name === 'powerusers');
@@ -37,7 +55,6 @@ function _routeAdmin(selectedAdminTab, errorPath, routeData) {
     app.showError(404, '', errorPath);
   }
 }
-
 // Routes
 page('*', scrollToTop, (ctx, next) => {
   next();
@@ -197,7 +214,12 @@ app.router = {
     }
     const isFullpath = /^http(s)?:\/\//.test(path);
     if (isFullpath) {
-      window.location = path;
+      const { encodepath, isvalidUrl } = getTrustedDomains(path);
+      if (isvalidUrl) {
+        const link = document.createElement('a');
+        link.setAttribute('href', encodepath);
+        link.click();
+      }
     } else {
       page(path);
     }

diff --git a/plugin/web-ui/addon/src/main/resources/OSGI-INF/web-ui-properties.xml b/plugin/web-ui/addon/src/main/resources/OSGI-INF/web-ui-properties.xml
@@ -36,7 +36,6 @@
     <!-- S3 Direct upload -->
     <property name="org.nuxeo.web.ui.s3.useDirectUpload">${nuxeo.s3storage.useDirectUpload:=false}</property>
 
-
     <!-- Redirect to final download url -->
     <property name="org.nuxeo.web.ui.url.followRedirect">${org.nuxeo.download.url.follow.redirect:=false}</property>
 
@@ -51,5 +50,9 @@
 
     <!-- Properties to be fetched when loading the user object in user management, default is empty -->
     <property name="org.nuxeo.web.ui.user.management.fetch.document" list="true"></property>
+
+    <!-- allowed url to redirect -->
+    <property name="org.nuxeo.web.ui.trustedDomains">${nuxeo.trustedDomains}</property>
+
   </extension>
-</component>
+</component>