You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@knox.apache.org by "hanicz (via GitHub)" <gi...@apache.org> on 2026/08/12 11:41:59 UTC

[PR] KNOX-3416: KnoxSSO redirects to untrusted site [knox]

hanicz opened a new pull request, #1346:
URL: https://github.com/apache/knox/pull/1346

   
   [KNOX-3416](https://issues.apache.org/jira/browse/KNOX-3416) - KnoxSSO redirects to untrusted site
   
   ## What changes were proposed in this pull request?
   
   KnoxSSO open redirect. `originalUrl=https://<knox-host>:443%252f@malicious.link/` bypassed the redirect whitelist — the whitelist check decoded the URL twice (seeing host <knox-host>), but the browser got the once-decoded Location and resolved the host to malicious.link. The `%2f@` trick hid the real host behind `userinfo`.
   
   In `WebSSOResource`, reject any redirect target containing `userinfo` (user@host) — checked on original, the exact value emitted in the Location header. Malformed URLs and `userinfo` results in 400.
   
   New unit tests for the scenario.
   
   ## How was this patch tested?
   
   Unit tests
   
   **Before:**
   
   ```
   curl -iku guest:guest-password 'https://localhost:8443/gateway/knoxsso/api/v1/websso?originalUrl=https://localhost:8443%252f@malicious.link/'
   HTTP/1.1 307 Temporary Redirect
   Date: Wed, 12 Aug 2026 11:34:14 GMT
   X-Frame-Options: DENY
   Expires: Thu, 01 Jan 1970 00:00:00 GMT
   Location: https://localhost:8443%2f@malicious.link/
   Content-Length: 0
   ```
   
   **After:**
   
   ```
   curl -iku guest:guest-password 'https://localhost:8443/gateway/knoxsso/api/v1/websso?originalUrl=https://localhost:8443%252f@malicious.link/'
   HTTP/1.1 400 Bad Request
   X-Frame-Options: DENY
   Set-Cookie: KNOXSESSIONID=node01c8rf5xqxudkxxp4188wx0kg70.node0; Path=/gateway/knoxsso; Secure; HttpOnly
   Set-Cookie: rememberMe=deleteMe; Path=/gateway/knoxsso; Max-Age=0; Expires=Tue, 11-Aug-2026 11:37:11 GMT; SameSite=lax
   Cache-Control: must-revalidate,no-cache,no-store
   Content-Type: text/html;charset=iso-8859-1
   Content-Length: 419
   
   <html>
   <head>
   <meta http-equiv="Content-Type" content="text/html;charset=ISO-8859-1"/>
   <title>Error 400 Bad Request</title>
   </head>
   <body><h2>HTTP ERROR 400 Bad Request</h2>
   <table>
   <tr><th>URI:</th><td>/gateway/knoxsso/api/v1/websso</td></tr>
   <tr><th>STATUS:</th><td>400</td></tr>
   <tr><th>MESSAGE:</th><td>Bad Request</td></tr>
   <tr><th>SERVLET:</th><td>knoxsso-knox-gateway-servlet</td></tr>
   </table>
   
   </body>
   </html>
   ```
   
   ## Integration Tests
   N/A
   
   ## UI changes
   N/A
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@knox.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] KNOX-3416: KnoxSSO redirects to untrusted site [knox]

Posted by "hanicz (via GitHub)" <gi...@apache.org>.
hanicz merged PR #1346:
URL: https://github.com/apache/knox/pull/1346


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@knox.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] KNOX-3416: KnoxSSO redirects to untrusted site [knox]

Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #1346:
URL: https://github.com/apache/knox/pull/1346#issuecomment-5266416091

   ## Test Results
   40 tests   40 ✅  6s ⏱️
    3 suites   0 💤
    3 files     0 ❌
   
   Results for commit 1f4cc830.
   
   [test-results]:data:application/gzip;base64,H4sIANNdfGoC/12MSQ6CQBBFr0J67aLsSfQypimopCLQpocV8e42qAzu/ns/eZMg7rsobpU6VSJmTiu0ObjEfixoC5YjzZeGH9xjRvwzD34Wswly3B9EF4IPXxPyuBbnfQh+xNZbeJdbeF9DPwycCogzacRawaWRVjltAJqrldIYbHWtDYFDAgkkXm/GDf2d/wAAAA==
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@knox.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org