[
https://issues.apache.org/jira/browse/KNOX-3416?focusedWorklogId=1035366&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1035366
]
ASF GitHub Bot logged work on KNOX-3416:
----------------------------------------
Author: ASF GitHub Bot
Created on: 12/Aug/26 11:41
Start Date: 12/Aug/26 11:41
Worklog Time Spent: 10m
Work Description: hanicz opened a new pull request, #1346:
URL: https://github.com/apache/knox/pull/1346
[KNOX-3416](https://issues.apache.org/jira/browse/KNOX-3416) - KnoxSSO
redirects to untrusted site
## What changes were proposed in this pull request?
KnoxSSO open redirect.
`originalUrl=https://<knox-host>:443%[email protected]/` bypassed the
redirect whitelist — the whitelist check decoded the URL twice (seeing host
<knox-host>), but the browser got the once-decoded Location and resolved the
host to malicious.link. The `%2f@` trick hid the real host behind `userinfo`.
In `WebSSOResource`, reject any redirect target containing `userinfo`
(user@host) — checked on original, the exact value emitted in the Location
header. Malformed URLs and `userinfo` results in 400.
New unit tests for the scenario.
## How was this patch tested?
Unit tests
**Before:**
```
curl -iku guest:guest-password
'https://localhost:8443/gateway/knoxsso/api/v1/websso?originalUrl=https://localhost:8443%[email protected]/'
HTTP/1.1 307 Temporary Redirect
Date: Wed, 12 Aug 2026 11:34:14 GMT
X-Frame-Options: DENY
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Location: https://localhost:[email protected]/
Content-Length: 0
```
**After:**
```
curl -iku guest:guest-password
'https://localhost:8443/gateway/knoxsso/api/v1/websso?originalUrl=https://localhost:8443%[email protected]/'
HTTP/1.1 400 Bad Request
X-Frame-Options: DENY
Set-Cookie: KNOXSESSIONID=node01c8rf5xqxudkxxp4188wx0kg70.node0;
Path=/gateway/knoxsso; Secure; HttpOnly
Set-Cookie: rememberMe=deleteMe; Path=/gateway/knoxsso; Max-Age=0;
Expires=Tue, 11-Aug-2026 11:37:11 GMT; SameSite=lax
Cache-Control: must-revalidate,no-cache,no-store
Content-Type: text/html;charset=iso-8859-1
Content-Length: 419
<html>
<head>
<meta http-equiv="Content-Type" content="text/html;charset=ISO-8859-1"/>
<title>Error 400 Bad Request</title>
</head>
<body><h2>HTTP ERROR 400 Bad Request</h2>
<table>
<tr><th>URI:</th><td>/gateway/knoxsso/api/v1/websso</td></tr>
<tr><th>STATUS:</th><td>400</td></tr>
<tr><th>MESSAGE:</th><td>Bad Request</td></tr>
<tr><th>SERVLET:</th><td>knoxsso-knox-gateway-servlet</td></tr>
</table>
</body>
</html>
```
## Integration Tests
N/A
## UI changes
N/A
Issue Time Tracking
-------------------
Worklog Id: (was: 1035366)
Remaining Estimate: 0h
Time Spent: 10m
> KnoxSSO redirects to untrusted site
> -----------------------------------
>
> Key: KNOX-3416
> URL: https://issues.apache.org/jira/browse/KNOX-3416
> Project: Apache Knox
> Issue Type: Bug
> Components: Server
> Affects Versions: 2.1.0, 3.0.0, 3.1.0
> Reporter: Tamás Hanicz
> Assignee: Tamás Hanicz
> Priority: Blocker
> Time Spent: 10m
> Remaining Estimate: 0h
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
