rootvector2 commented on code in PR #3624:
URL: https://github.com/apache/cxf/pull/3624#discussion_r4369826627
##########
rt/transports/http/src/main/java/org/apache/cxf/transport/http/HTTPConduit.java:
##########
@@ -1908,7 +1908,7 @@ private static void checkAllowedRedirectUri(String
conduitName,
}
String allowedRedirectURI =
(String)message.getContextualProperty(AUTO_REDIRECT_ALLOWED_URI);
- if (allowedRedirectURI != null &&
!newURL.startsWith(allowedRedirectURI)) {
+ if (allowedRedirectURI != null && !isAllowedRedirectUri(newUri,
newURL, allowedRedirectURI)) {
Review Comment:
Makes sense. With `http.redirect.same.host.only` set, the `@evil.example`
and `.evil.example` redirects are already rejected, and a configured value with
a trailing `/` (e.g. `https://api.example.com/`) closes it for
`http.redirect.allowed.uri` too. So this is a config concern rather than a bug
in the check. Happy to close this, or turn it into a short doc note on the
property that the value is a raw prefix match, whichever you prefer.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
