feat: properly handle redirect url fragments and unusual hostnames

Author: hf

internal/api/verify_test.go

@@ -657,6 +657,20 @@ func (ts *VerifyTestSuite) TestVerifySignupWithRedirectURLContainedPath() {
 			requestredirectURL:  "http://test.dev:3000/bar/foo",
 			expectedredirectURL: "http://localhost:3000",
 		},
+		{
+			desc:                "redirect ignores fragment for validation",
+			siteURL:             "http://localhost:3000",
+			uriAllowList:        []string{"http://*.example.com/*"},
+			requestredirectURL:  "http://something#.example.com/abc",
+			expectedredirectURL: "http://localhost:3000",
+		},
+		{
+			desc:                "redirect ignores unusual hostnames",
+			siteURL:             "http://localhost:3000",
+			uriAllowList:        []string{"http://*.example.com/*"},
+			requestredirectURL:  "http://japanese。.example.com/abc",
+			expectedredirectURL: "http://localhost:3000",
+		},
 	}
 
 	for _, tC := range testCases {

internal/utilities/request.go

@@ -81,6 +81,7 @@ func GetReferrer(r *http.Request, config *conf.GlobalConfiguration) string {
 }
 
 var decimalIPAddressPattern = regexp.MustCompile("^[0-9]+$")
+var regularHostname = regexp.MustCompile("^[a-zA-Z0-9]([a-zA-Z0-9.-]*[a-zA-Z0-9])?$")
 
 func IsRedirectURLValid(config *conf.GlobalConfiguration, redirectURL string) bool {
 	if redirectURL == "" {
@@ -105,11 +106,17 @@ func IsRedirectURLValid(config *conf.GlobalConfiguration, redirectURL string) bo
 		return false
 	} else if ip := net.ParseIP(refurl.Hostname()); ip != nil {
 		return ip.IsLoopback()
+	} else if !regularHostname.MatchString(refurl.Hostname()) {
+		// hostname uses characters that are not typically used
+		return false
 	}
 
 	// For case when user came from mobile app or other permitted resource - redirect back
 	for _, pattern := range config.URIAllowListMap {
-		if pattern.Match(redirectURL) {
+		// only match without the fragment
+		matchAgainst, _, _ := strings.Cut(redirectURL, "#")
+
+		if pattern.Match(matchAgainst) {
 			return true
 		}
 	}