public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Apply security patch security-patch-202505051005.patch (#105754)

Browse Source 
* Fix static handler redirect logic to ensure proper clean up URLs before redirection.

(cherry picked from commit f50ec8e0d10c24fd79f6c454974a2fc6e9694ef2)
This commit is contained in:
Sofia Papagiannaki
2025-05-21 21:34:05 +03:00
committed by GitHub
parent 1dd59ca599
commit c7a690348d
2 changed files with 183 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/api/static/static.go
+6 -5
View File
@@ -159,16 +159,17 @@ func staticHandler(ctx *web.Context, log log.Logger, opt StaticOptions) bool {
if fi.IsDir() {
// Redirect if missing trailing slash.
if !strings.HasSuffix(ctx.Req.URL.Path, "/") {
path := fmt.Sprintf("%s/", ctx.Req.URL.Path)
if !strings.HasPrefix(path, "/") {
redirectPath := path.Clean(ctx.Req.URL.Path)
redirectPath = fmt.Sprintf("%s/", redirectPath)
if !strings.HasPrefix(redirectPath, "/") {
// Disambiguate that it's a path relative to this server
path = fmt.Sprintf("/%s", path)
redirectPath = fmt.Sprintf("/%s", redirectPath)
} else {
// A string starting with // or /\ is interpreted by browsers as a URL, and not a server relative path
rePrefix := regexp.MustCompile(`^(?:/\\|/+)`)
path = rePrefix.ReplaceAllString(path, "/")
redirectPath = rePrefix.ReplaceAllString(redirectPath, "/")
}
http.Redirect(ctx.Resp, ctx.Req, path, http.StatusFound)
http.Redirect(ctx.Resp, ctx.Req, redirectPath, http.StatusFound)
return true
}