From 190a9470e234bbd9ac5d5de43f5a19aead9a2c21 Mon Sep 17 00:00:00 2001 From: Jon Koops Date: Wed, 18 Jan 2023 15:51:35 +0100 Subject: [PATCH] Prevent open redirect when checking SSO Co-authored-by: Jasu Viding --- middleware/check-sso.js | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/middleware/check-sso.js b/middleware/check-sso.js index a28b0035..88daa13a 100644 --- a/middleware/check-sso.js +++ b/middleware/check-sso.js @@ -61,7 +61,8 @@ module.exports = function (keycloak) { delete urlParts.query.auth_callback delete urlParts.query.state - const cleanUrl = URL.format(urlParts) + // Collapse leading slashes to a single slash to prevent open redirects + const cleanUrl = URL.format(urlParts).replace(/^\/+/, '/') // Check SSO process is completed request.session.auth_is_check_sso_complete = true