This is an automated email from the ASF dual-hosted git repository.
cziegeler pushed a commit to branch master
in repository
https://gitbox.apache.org/repos/asf/sling-org-apache-sling-auth-core.git
The following commit(s) were added to refs/heads/master by this push:
new c13923b fix(auth): sanitize redirect target in log messages to
prevent log injection (#25)
c13923b is described below
commit c13923b706ebcf80a42621cf6e652785c5fab503
Author: Carsten Ziegeler <[email protected]>
AuthorDate: Tue Jun 2 16:46:29 2026 +0200
fix(auth): sanitize redirect target in log messages to prevent log
injection (#25)
Co-authored-by: Maia <maia@noreply>
---
.../java/org/apache/sling/auth/core/AuthUtil.java | 41 ++++++++++++++--------
1 file changed, 27 insertions(+), 14 deletions(-)
diff --git a/src/main/java/org/apache/sling/auth/core/AuthUtil.java
b/src/main/java/org/apache/sling/auth/core/AuthUtil.java
index af88016..e50a668 100644
--- a/src/main/java/org/apache/sling/auth/core/AuthUtil.java
+++ b/src/main/java/org/apache/sling/auth/core/AuthUtil.java
@@ -832,6 +832,7 @@ public final class AuthUtil {
getLog().warn("isRedirectValid: Redirect target must not be empty
or null");
return false;
}
+ final String sanitizedTarget = sanitizeForLog(target);
try {
new URI(target);
@@ -841,7 +842,7 @@ public final class AuthUtil {
}
if (target.contains("://")) {
- getLog().warn("isRedirectValid: Redirect target '{}' must not be
an URL", target);
+ getLog().warn("isRedirectValid: Redirect target '{}' must not be
an URL", sanitizedTarget);
return false;
}
@@ -850,16 +851,17 @@ public final class AuthUtil {
|| target.contains("/./")
|| target.endsWith("/.")
|| target.endsWith("/..")) {
- getLog().warn("isRedirectValid: Redirect target '{}' is not
normalized", target);
+ getLog().warn("isRedirectValid: Redirect target '{}' is not
normalized", sanitizedTarget);
return false;
}
final String ctxPath = getContextPath(request);
if (ctxPath.length() > 0 && !target.startsWith(ctxPath)) {
+ final String sanitizedCtxPath = sanitizeForLog(ctxPath);
getLog().warn(
"isRedirectValid: Redirect target '{}' does not
start with servlet context path '{}'",
- target,
- ctxPath);
+ sanitizedTarget,
+ sanitizedCtxPath);
return false;
}
@@ -870,10 +872,11 @@ public final class AuthUtil {
final String localTarget = target.substring(ctxPath.length());
if (!localTarget.startsWith("/")) {
+ final String sanitizedCtxPath = sanitizeForLog(ctxPath);
getLog().warn(
"isRedirectValid: Redirect target '{}' without
servlet context path '{}' must be an absolute path",
- target,
- ctxPath);
+ sanitizedTarget,
+ sanitizedCtxPath);
return false;
}
@@ -889,7 +892,7 @@ public final class AuthUtil {
// not resolving to a resource, check for illegal characters
final Pattern illegal = Pattern.compile("[<>'\"]");
if (illegal.matcher(path).find()) {
- getLog().warn("isRedirectValid: Redirect target '{}' must not
contain any of <>'\"", target);
+ getLog().warn("isRedirectValid: Redirect target '{}' must not
contain any of <>'\"", sanitizedTarget);
return false;
}
@@ -938,6 +941,7 @@ public final class AuthUtil {
getLog().warn("isRedirectValid: Redirect target must not be empty
or null");
return false;
}
+ final String sanitizedTarget = sanitizeForLog(target);
try {
new URI(target);
@@ -947,7 +951,7 @@ public final class AuthUtil {
}
if (target.contains("://")) {
- getLog().warn("isRedirectValid: Redirect target '{}' must not be
an URL", target);
+ getLog().warn("isRedirectValid: Redirect target '{}' must not be
an URL", sanitizedTarget);
return false;
}
@@ -956,16 +960,17 @@ public final class AuthUtil {
|| target.contains("/./")
|| target.endsWith("/.")
|| target.endsWith("/..")) {
- getLog().warn("isRedirectValid: Redirect target '{}' is not
normalized", target);
+ getLog().warn("isRedirectValid: Redirect target '{}' is not
normalized", sanitizedTarget);
return false;
}
final String ctxPath = getContextPath(request);
if (ctxPath.length() > 0 && !target.startsWith(ctxPath)) {
+ final String sanitizedCtxPath = sanitizeForLog(ctxPath);
getLog().warn(
"isRedirectValid: Redirect target '{}' does not
start with servlet context path '{}'",
- target,
- ctxPath);
+ sanitizedTarget,
+ sanitizedCtxPath);
return false;
}
@@ -976,10 +981,11 @@ public final class AuthUtil {
final String localTarget = target.substring(ctxPath.length());
if (!localTarget.startsWith("/")) {
+ final String sanitizedCtxPath = sanitizeForLog(ctxPath);
getLog().warn(
"isRedirectValid: Redirect target '{}' without
servlet context path '{}' must be an absolute path",
- target,
- ctxPath);
+ sanitizedTarget,
+ sanitizedCtxPath);
return false;
}
@@ -995,7 +1001,7 @@ public final class AuthUtil {
// not resolving to a resource, check for illegal characters
final Pattern illegal = Pattern.compile("[<>'\"]");
if (illegal.matcher(path).find()) {
- getLog().warn("isRedirectValid: Redirect target '{}' must not
contain any of <>'\"", target);
+ getLog().warn("isRedirectValid: Redirect target '{}' must not
contain any of <>'\"", sanitizedTarget);
return false;
}
@@ -1024,6 +1030,13 @@ public final class AuthUtil {
return "";
}
+ private static String sanitizeForLog(final String value) {
+ if (value == null) {
+ return null;
+ }
+ return value.replace("\r", "\\r").replace("\n", "\\n");
+ }
+
/**
* Returns the resource resolver set as the
* {@link AuthenticationSupport#REQUEST_ATTRIBUTE_RESOLVER} request
