[jira] [Work logged] (KNOX-2655) Disallow Userinfo in KnoxSSO originalURL Query Param

["ASF GitHub Bot (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/KNOX-2655?focusedWorklogId=672960&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-672960 ]

ASF GitHub Bot logged work on KNOX-2655:
----------------------------------------

                Author: ASF GitHub Bot
            Created on: 02/Nov/21 04:38
            Start Date: 02/Nov/21 04:38
    Worklog Time Spent: 10m 
      Work Description: lmccay opened a new pull request #514:
URL: https://github.com/apache/knox/pull/514


   ## What changes were proposed in this pull request?
   Invalidate any originalUrl being used in the flow for KnoxSSO that contains user information (username and password).
   There is no reason for an SSO flow to result in username and password being sent by the browser as part of the URL and would represent poor credential hygiene.
   
   This change explicitly checks the incoming originalUrl for the existence of userInfo and if the url contains it the flow is disrupted as possible phishing attack.
   
   ## How was this patch tested?
   
   Existing unit tests and new unit tests added for Urls.containsUserInfo method.
   Manually tested a url with userinfo and observed expected behavior.
   Manually tested a valid url and observed normal KnoxSSO flow success.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@knox.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


Issue Time Tracking
-------------------

            Worklog Id:     (was: 672960)
    Remaining Estimate: 0h
            Time Spent: 10m

> Disallow Userinfo in KnoxSSO originalURL Query Param
> ----------------------------------------------------
>
>                 Key: KNOX-2655
>                 URL: https://issues.apache.org/jira/browse/KNOX-2655
>             Project: Apache Knox
>          Issue Type: Improvement
>          Components: KnoxSSO
>            Reporter: Larry McCay
>            Priority: Major
>             Fix For: 2.0.0
>
>          Time Spent: 10m
>  Remaining Estimate: 0h
>
> There is no valid reason that I can think of to allow userinfo in a URL for an application/UI that is participating in KnoxSSO. The userinfo is used to login to hosts/pages that are protected by HTTP Basic. This is contradictory to the use of KnoxSSO to begin with and complicates the regex pattern required to indicate those URLs that are allowed for redirect and/or dispatch.



--
This message was sent by Atlassian Jira
(v8.3.4#803005)