Vulnerability fix: validate return_to param using request.host #3627
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
nicoayala
changed the title
mshibuya
reviewed
Jun 17, 2023
| @@ -56,7 +56,7 @@ def respond_to_missing?(sym, include_private) | |||
| end | |||
|
|
|||
| def back_or_index | |||
| params[:return_to].presence && params[:return_to].include?(request.host) && (params[:return_to] != request.fullpath) ? params[:return_to] : index_path | |||
| params[:return_to].presence && params[:return_to].starts_with?(request.host) && (params[:return_to] != request.fullpath) ? params[:return_to] : index_path | |||
There was a problem hiding this comment.
But request.host is in the form of www.example.com. So this won't allow the valid url https://www.example.com/, right?
There was a problem hiding this comment.
You are right, we need to take the scheme into account. I'll fix it. Thx 🙌 !
mshibuya
reviewed
Jun 17, 2023
nicoayala
force-pushed
the
3.x-validate-redirect-host
branch
from
72d1ab8 to
287e207
Compare
codealchemy
reviewed
Jun 28, 2023
codealchemy
approved these changes
Jun 29, 2023
|
The failing check is rubocop in: Is this being addressed? Let me know how should I proceed |
|
Merged in. Thank you for the fix! |
|
The Rubocop failure was already addressed in the master: |
jklimke
added a commit
to 3dcl/rails_admin
that referenced
this pull request
Nov 28, 2023
* 'master' of github.com:railsadminteam/rails_admin: Tidy up gemfiles Bump jRuby Test against Mongoid 8 Test against Rails 7.1 Mitigate jRuby build failures Upgrade node and vite to fix the vite build Un-pin turbo-rails to fix Rails 6.1 builds Follow-up for railsadminteam#3555 Resolved a problem with embedded mongoid documents and boolean selectors (railsadminteam#3555) Stop using update_only to decide to show subform on create (railsadminteam#3649) Follow-up for railsadminteam#3643 Basic vite integration attempt (railsadminteam#3643) Support client-side dynamic scoping Fix Rubocop offense Revive the live demo Unlock webrick version Fix typo: tripple ==> triple (railsadminteam#3637) Replace ” entity with inline <q> element (railsadminteam#3636) Vulnerability fix: validate return_to param using request.host (railsadminteam#3627) Fix Rubocop offense
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Context
An internal team audits the Maxwell Rails apps occasionally, and in the last run, they discovered a vulnerability. Please take a look at the details bellow:
Solution
Validate the URL starts with the
request.hostrequest.base_url