You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@knox.apache.org by "hanicz (via GitHub)" <gi...@apache.org> on 2026/09/25 06:55:47 UTC

[PR] KNOX-3488: Harden original-url validation [knox]

hanicz opened a new pull request, #1429:
URL: https://github.com/apache/knox/pull/1429

   [KNOX-3488](https://issues.apache.org/jira/browse/KNOX-3488) - harden original-url cookie validation
   
   ## What changes were proposed in this pull request?
   
   - `WebSSOResource` validated the redirect target only when it came from the `originalUrl` query param — the `original-url`cookie branch used the value verbatim, skipping the userinfo and whitelist checks. A request carrying a crafted cookie was redirected to any attacker host, bypassing the configured (and default) whitelist.
   
   ## How was this patch tested?
   
   Tested locally, new unit tests, homepage login
   
   ```
   curl -iku guest:guest-password --cookie "original-url=https://draco.malfoy" 'https://localhost:8443/gateway/knoxsso/api/v1/websso'
   
   HTTP/1.1 400 Bad Request
   
   curl -iku guest:guest-password --cookie "original-url=https://localhost:8443@draco.malfoy" 'https://localhost:8443/gateway/knoxsso/api/v1/websso'
   
   HTTP/1.1 400 Bad Request
   
   curl -iku guest:guest-password --cookie "original-url=https://localhost:8443%252f@draco.malfoy" 'https://localhost:8443/gateway/knoxsso/api/v1/websso'
   
   HTTP/1.1 400 Bad Request
   
   curl -iku guest:guest-password 'https://localhost:8443/gateway/knoxsso/api/v1/websso?originalUrl=https://localhost:8443%252f@malicious.link/'
   
   HTTP/1.1 400 Bad Request
   ```


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@knox.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] KNOX-3488: Harden original-url validation [knox]

Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #1429:
URL: https://github.com/apache/knox/pull/1429#issuecomment-5828383737

   ## Test Results
     4 files    4 suites   2m 51s ⏱️
   127 tests 127 ✅ 0 💤 0 ❌
   145 runs  145 ✅ 0 💤 0 ❌
   
   Results for commit 42cf220b.
   
   [test-results]:data:application/gzip;base64,H4sIAModtmoC/12Nyw7CIBQFf6Vh7QIoBOvPGF43IbbF8FgZ/90rqYguZ04y50EgrD6TyyROE8k1lA6uJl1C3BGZYihwKu+RcfWha67W/qtbuKOiXYAO64/wKcV0mFT31hTygJ4czLfYeAg2Hns2blsoCERwC5xTI41Qki+wMH+WXEgws2JAnZaOzfhCni+XhwmyBQEAAA==
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@knox.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] KNOX-3488: Harden original-url cookie validation [knox]

Posted by "bonampak (via GitHub)" <gi...@apache.org>.
bonampak commented on code in PR #1429:
URL: https://github.com/apache/knox/pull/1429#discussion_r4157306905


##########
gateway-service-knoxsso/src/test/java/org/apache/knox/gateway/service/knoxsso/WebSSOResourceTest.java:
##########
@@ -516,6 +516,92 @@ public void testUserInfoOriginalURLRejected() throws Exception {
     assertEquals(HttpStatus.SC_BAD_REQUEST, e.getResponse().getStatus());
   }
 
+  @Test
+  public void testWhitelistValidationAppliedToOriginalUrlCookie() throws Exception {

Review Comment:
   this testWhitelistValidationAppliedToOriginalUrlCookie() and testUserInfoInOriginalUrlCookieRejected()
   both test the unhappy path where the original-url cookie is invalid. 
   
   We should still have a test that given a valid original-url cookie, when a GET is called, then a token (hadoop-jwt cookie) is issued and the original-url cookie is cleared.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@knox.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] KNOX-3488: Harden original-url cookie validation [knox]

Posted by "hanicz (via GitHub)" <gi...@apache.org>.
hanicz merged PR #1429:
URL: https://github.com/apache/knox/pull/1429


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@knox.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org