Mirror/app-MAIL-temp
1
0
Fork 0
mirror of https://github.com/simple-login/app.git synced 2024-11-18 01:40:38 +01:00
Code Issues Projects Releases Packages Wiki Activity

Mitigate open redirect with OAuth (#1176)

Browse source 
* Mitigate open redirect with OAuth

* Fix tests
This commit is contained in:
Carlos Quintana 2022-07-21 14:23:08 +02:00 committed by GitHub
parent 598d912f2e
commit f1b22d4ef9
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 6 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
app/oauth/views/authorize.py
View file

@ -78,13 +78,13 @@ def authorize():
if hostname != "localhost" and hostname != "127.0.0.1": if hostname != "localhost" and hostname != "127.0.0.1":
# support custom scheme for mobile app # support custom scheme for mobile app
if scheme == "http": if scheme == "http":
final_redirect_uri = f"{redirect_uri}?error=http_not_allowed" flash("The external client must use HTTPS", "error")
return redirect(final_redirect_uri) return redirect(url_for("dashboard.index"))
# check if redirect_uri is valid # check if redirect_uri is valid
if not RedirectUri.get_by(client_id=client.id, uri=redirect_uri): if not RedirectUri.get_by(client_id=client.id, uri=redirect_uri):
final_redirect_uri = f"{redirect_uri}?error=unknown_redirect_uri" flash("The external client is using an invalid URL", "error")
return redirect(final_redirect_uri) return redirect(url_for("dashboard.index"))
# redirect from client website # redirect from client website
if request.method == "GET": if request.method == "GET":

4
tests/oauth/test_authorize.py
View file

@ -724,7 +724,7 @@ def test_authorize_page_http_not_allowed(flask_client):
) )
assert r.status_code == 302 assert r.status_code == 302
assert r.location == "http://mywebsite.com?error=http_not_allowed" assert r.location == url_for("dashboard.index")
def test_authorize_page_unknown_redirect_uri(flask_client): def test_authorize_page_unknown_redirect_uri(flask_client):
@ -746,4 +746,4 @@ def test_authorize_page_unknown_redirect_uri(flask_client):
) )
assert r.status_code == 302 assert r.status_code == 302
assert r.location == "https://unknown.com?error=unknown_redirect_uri" assert r.location == url_for("dashboard.index")