public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Forbid more redirect patterns (#110337)

Browse Source
This commit is contained in:
xavi
2025-09-02 16:12:39 +02:00
committed by GitHub
parent 95f167bb8b
commit 16b7535dd4
4 changed files with 23 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/api/user_token_test.go
+2 -1
View File
@@ -166,6 +166,7 @@ func TestHTTPServer_RotateUserAuthTokenRedirect(t *testing.T) {
// Invalid redirects should be converted to root
{"backslash domain", `/\grafana.com`, "/"},
{"backslash domain at the start of the path", `/\grafana.com/../a`, "/"},
{"traversal backslash domain", `/a/../\grafana.com`, "/"},
{"double slash", "//grafana", "/"},
{"missing initial slash", "missingInitialSlash", "/"},
@@ -232,7 +233,7 @@ func TestHTTPServer_RotateUserAuthTokenRedirect(t *testing.T) {
res, err := server.Send(req)
require.NoError(t, err)
assert.Equal(t, 302, redirectStatusCode)
assert.Equal(t, redirectCase.expectedUrl, redirectLocation)
assert.Equal(t, redirectCase.expectedUrl, redirectLocation, "redirectTo=%s", redirectCase.redirectUrl)
require.NoError(t, res.Body.Close())
})