public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[release-12.1.2] Forbid more redirect patterns (#110502)

Browse Source
This commit is contained in:
grafana-delivery-bot[bot]
2025-09-03 11:13:16 +02:00
committed by GitHub
parent 52ecba092c
commit 74ead49ccb
4 changed files with 23 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/api/user_token_test.go
+2 -1
View File
@@ -166,6 +166,7 @@ func TestHTTPServer_RotateUserAuthTokenRedirect(t *testing.T) {
// Invalid redirects should be converted to root
{"backslash domain", `/\grafana.com`, "/"},
{"backslash domain at the start of the path", `/\grafana.com/../a`, "/"},
{"traversal backslash domain", `/a/../\grafana.com`, "/"},
{"double slash", "//grafana", "/"},
{"missing initial slash", "missingInitialSlash", "/"},
@@ -232,7 +233,7 @@ func TestHTTPServer_RotateUserAuthTokenRedirect(t *testing.T) {
res, err := server.Send(req)
require.NoError(t, err)
assert.Equal(t, 302, redirectStatusCode)
assert.Equal(t, redirectCase.expectedUrl, redirectLocation)
assert.Equal(t, redirectCase.expectedUrl, redirectLocation, "redirectTo=%s", redirectCase.redirectUrl)
require.NoError(t, res.Body.Close())
})