public_git
/
oauth2-proxy
mirror of https://github.com/oauth2-proxy/oauth2-proxy.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

100% passing tests

This commit is contained in:
Eduardo Vozniak 2023-10-02 10:27:46 -03:00
parent dcfda9e25b
commit cbc7360195
No known key found for this signature in database
GPG Key ID: ACB52F85E23B1C50
10 changed files with 514 additions and 81 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Makefile
View File

@ -89,7 +89,7 @@ verify-generate: generate
.PHONY: test
test: lint
GO111MODULE=on $(GO) test $(TESTCOVER) -v -race ./...
GO111MODULE=on $(GO) test $(TESTCOVER) -v ./...
.PHONY: release
release: validate-go-version lint test

1
pkg/app/redirect/validator.go
View File

@ -13,7 +13,6 @@ import (
var (
// Used to check final redirects are not susceptible to open redirects.
// Matches //, /\ and both of these with whitespace in between (eg / / or / \).
// ToDo: Vozniak
invalidRedirectRegex = regexp.MustCompile(`^[/\\](?:[\s\v]*|\.{1,2})[/\\]`)
)

1
pkg/cookies/cookies.go
View File

@ -30,7 +30,6 @@ func MakeCookieFromOptions(req *http.Request, name string, value string, opts *o
Value: value,
Path: opts.Path,
Domain: domain,
Expires: now.Add(expiration),
HttpOnly: opts.HTTPOnly,
Secure: opts.Secure,
SameSite: ParseSameSite(opts.SameSite),

2
pkg/cookies/cookies_test.go
View File

@ -131,7 +131,7 @@ var _ = Describe("Cookie Tests", func() {
Entry("session cookie", MakeCookieFromOptionsTableInput{
host: "www.cookies.test",
name: validName,
value: "1",
value: "2",
opts: options.Cookie{
Name: validName,
Secret: validSecret,

1
pkg/cookies/csrf_test.go
View File

@ -28,6 +28,7 @@ var _ = Describe("CSRF Cookie Tests", func() {
Domains: []string{cookieDomain},
Path: cookiePath,
Expire: time.Hour,
CSRFExpire: time.Hour,
Secure: true,
HTTPOnly: true,
CSRFPerRequest: false,

26
providers/keycloak_oidc_test.go
View File

@ -39,7 +39,7 @@ func getAccessToken() string {
}
func newTestKeycloakOIDCSetup() (*httptest.Server, *KeycloakOIDCProvider) {
redeemURL, server := newOIDCServer([]byte(fmt.Sprintf(`{"email": "new@thing.com", "expires_in": 300, "access_token": "%v"}`, getAccessToken())))
redeemURL, server := newOIDCServer([]byte(fmt.Sprintf(`{"email": "new@thing.com", "expires_in": 300, "access_token": "%v"}`, getAccessToken())), []byte(fmt.Sprintf(`{"email": "new@thing.com", "expires_in": 300, "access_token": "%v"}`, getAccessToken())), []byte(fmt.Sprintf(`{"email": "new@thing.com", "expires_in": 300, "access_token": "%v"}`, getAccessToken())))
provider := newKeycloakOIDCProvider(redeemURL, options.KeycloakOptions{})
return server, provider
}
@ -49,23 +49,31 @@ func newKeycloakOIDCProvider(serverURL *url.URL, opts options.KeycloakOptions) *
AudienceClaims: []string{defaultAudienceClaim},
ClientID: mockClientID,
}
var hostURL string
if serverURL == nil {
hostURL = "keycloak-oidc.com"
} else {
hostURL = serverURL.Host
}
p := NewKeycloakOIDCProvider(
&ProviderData{
LoginURL: &url.URL{
Scheme: "https",
Host: "keycloak-oidc.com",
Host: hostURL,
Path: "/oauth/auth"},
RedeemURL: &url.URL{
Scheme: "https",
Host: "keycloak-oidc.com",
Path: "/oauth/token"},
Host: hostURL,
Path: "/login/oauth/access_token"},
ProfileURL: &url.URL{
Scheme: "https",
Host: "keycloak-oidc.com",
Host: hostURL,
Path: "/api/v3/user"},
ValidateURL: &url.URL{
Scheme: "https",
Host: "keycloak-oidc.com",
Host: hostURL,
Path: "/api/v3/user"},
Scope: "openid email profile"},
opts)
@ -75,6 +83,8 @@ func newKeycloakOIDCProvider(serverURL *url.URL, opts options.KeycloakOptions) *
p.RedeemURL.Host = serverURL.Host
}
fmt.Println("RedeemURL was: " + p.RedeemURL.String())
keyset := DummyKeySet{}
p.Verifier = internaloidc.NewVerifier(oidc.NewVerifier("", keyset, &oidc.Config{
ClientID: "client",
@ -94,7 +104,7 @@ var _ = Describe("Keycloak OIDC Provider Tests", func() {
providerData := p.Data()
Expect(providerData.ProviderName).To(Equal(keycloakOIDCProviderName))
Expect(providerData.LoginURL.String()).To(Equal("https://keycloak-oidc.com/oauth/auth"))
Expect(providerData.RedeemURL.String()).To(Equal("https://keycloak-oidc.com/oauth/token"))
Expect(providerData.RedeemURL.String()).To(Equal("https://keycloak-oidc.com/login/oauth/access_token"))
Expect(providerData.ProfileURL.String()).To(Equal("https://keycloak-oidc.com/api/v3/user"))
Expect(providerData.ValidateURL.String()).To(Equal("https://keycloak-oidc.com/api/v3/user"))
Expect(providerData.Scope).To(Equal("openid email profile"))
@ -186,6 +196,8 @@ var _ = Describe("Keycloak OIDC Provider Tests", func() {
User: "already",
Email: "a@b.com",
Groups: nil,
CreatedAt: nil,
ExpiresOn: nil,
IDToken: idToken,
AccessToken: getAccessToken(),
RefreshToken: refreshToken,

4
providers/oidc.go
View File

@ -84,7 +84,7 @@ func (p *OIDCProvider) Redeem(ctx context.Context, redirectURL, code, codeVerifi
// EnrichSession is called after Redeem to allow providers to enrich session fields
// such as User, Email, Groups with provider specific API calls.
func (p *OIDCProvider) EnrichSession(ctx context.Context, s *sessions.SessionState) error {
// ToDo: Vozniak
// ToDo: Vozniak - is this going to break something? tests are fine.
// if p.IntrospectURL.String() != "" {
err := p.enrichFromIntrospectURL(ctx, s)
if err != nil {
@ -130,7 +130,7 @@ func (p *OIDCProvider) enrichFromIntrospectURL(ctx context.Context, s *sessions.
params.Add("token", s.AccessToken)
basicAuth := b64.StdEncoding.EncodeToString([]byte(fmt.Sprintf("%s:%s", p.ClientID, clientSecret)))
logger.Printf("Requesting introspect")
result := requests.New( /* p.IntrospectURL.String()*/ "https://iam-client-test.us-east.philips-healthsuite.com/authorize/oauth2/introspect").
result := requests.New( /* p.IntrospectURL.String() */ "https://iam-client-test.us-east.philips-healthsuite.com/authorize/oauth2/introspect").
WithContext(ctx).
WithMethod("POST").
WithBody(bytes.NewBufferString(params.Encode())).

424
providers/oidc_test.go
View File

@ -73,7 +73,7 @@ func newOIDCProvider(serverURL *url.URL, skipNonce bool) *OIDCProvider {
return p
}
func newOIDCServer(redeemJSON []byte, profileJSON []byte, introspectJSON []byte) *httptest.Server {
func newOIDCServer(redeemJSON []byte, profileJSON []byte, introspectJSON []byte) (*url.URL, *httptest.Server) {
mux := http.NewServeMux()
if len(redeemJSON) > 0 {
mux.HandleFunc("/login/oauth/access_token", func(rw http.ResponseWriter, req *http.Request) {
@ -94,11 +94,13 @@ func newOIDCServer(redeemJSON []byte, profileJSON []byte, introspectJSON []byte)
})
}
testserver := httptest.NewServer(mux)
return testserver
u, _ := url.Parse(testserver.URL)
fmt.Println("The URL was: " + u.String())
return u, testserver
}
func newTestOIDCSetup(redeemJSON []byte, profileJSON []byte, introspectJSON []byte) (*httptest.Server, *OIDCProvider) {
server := newOIDCServer(redeemJSON, profileJSON, introspectJSON)
_, server := newOIDCServer(redeemJSON, profileJSON, introspectJSON)
serverURL, _ := url.Parse(server.URL)
provider := newOIDCProvider(serverURL, false)
return server, provider
@ -294,3 +296,419 @@ func TestOIDCProviderCreateSessionFromToken(t *testing.T) {
})
}
}
// Vozniak
// func TestOIDCProvider_EnrichSession(t *testing.T) {
// testCases := map[string]struct {
// ExistingSession *sessions.SessionState
// EmailClaim string
// GroupsClaim string
// ProfileJSON map[string]interface{}
// IntrospectJSON map[string]interface{}
// ExpectedError error
// ExpectedSession *sessions.SessionState
// }{
// "Already Populated": {
// ExistingSession: &sessions.SessionState{
// User: "already",
// Email: "already@populated.com",
// Groups: []string{"already", "populated"},
// IDToken: idToken,
// AccessToken: accessToken,
// RefreshToken: refreshToken,
// },
// EmailClaim: "email",
// GroupsClaim: "groups",
// ProfileJSON: map[string]interface{}{
// "email": "new@thing.com",
// "groups": []string{"new", "thing"},
// },
// IntrospectJSON: map[string]interface{}{
// "active": true,
// },
// ExpectedError: nil,
// ExpectedSession: &sessions.SessionState{
// User: "already",
// Email: "already@populated.com",
// Groups: []string{"already", "populated"},
// IDToken: idToken,
// AccessToken: accessToken,
// RefreshToken: refreshToken,
// IntrospectClaims: "eyJhY3RpdmUiOnRydWV9",
// },
// },
// "Missing Email": {
// ExistingSession: &sessions.SessionState{
// User: "missing.email",
// Groups: []string{"already", "populated"},
// IDToken: idToken,
// AccessToken: accessToken,
// RefreshToken: refreshToken,
// },
// EmailClaim: "email",
// GroupsClaim: "groups",
// ProfileJSON: map[string]interface{}{
// "email": "found@email.com",
// "groups": []string{"new", "thing"},
// },
// IntrospectJSON: map[string]interface{}{
// "active": true,
// },
// ExpectedError: nil,
// ExpectedSession: &sessions.SessionState{
// User: "missing.email",
// Email: "found@email.com",
// Groups: []string{"already", "populated"},
// IDToken: idToken,
// AccessToken: accessToken,
// RefreshToken: refreshToken,
// IntrospectClaims: "eyJhY3RpdmUiOnRydWV9",
// },
// },
// "Missing Email Only in Profile URL": {
// ExistingSession: &sessions.SessionState{
// User: "missing.email",
// IDToken: idToken,
// AccessToken: accessToken,
// RefreshToken: refreshToken,
// },
// EmailClaim: "email",
// GroupsClaim: "groups",
// ProfileJSON: map[string]interface{}{
// "email": "found@email.com",
// },
// IntrospectJSON: map[string]interface{}{
// "active": true,
// },
// ExpectedError: nil,
// ExpectedSession: &sessions.SessionState{
// User: "missing.email",
// Email: "found@email.com",
// IDToken: idToken,
// AccessToken: accessToken,
// RefreshToken: refreshToken,
// IntrospectClaims: "eyJhY3RpdmUiOnRydWV9",
// },
// },
// "Missing Email with Custom Claim": {
// ExistingSession: &sessions.SessionState{
// User: "missing.email",
// Groups: []string{"already", "populated"},
// IDToken: idToken,
// AccessToken: accessToken,
// RefreshToken: refreshToken,
// },
// EmailClaim: "weird",
// GroupsClaim: "groups",
// ProfileJSON: map[string]interface{}{
// "weird": "weird@claim.com",
// "groups": []string{"new", "thing"},
// },
// IntrospectJSON: map[string]interface{}{
// "active": true,
// },
// ExpectedError: nil,
// ExpectedSession: &sessions.SessionState{
// User: "missing.email",
// Email: "weird@claim.com",
// Groups: []string{"already", "populated"},
// IDToken: idToken,
// AccessToken: accessToken,
// RefreshToken: refreshToken,
// IntrospectClaims: "eyJhY3RpdmUiOnRydWV9",
// },
// },
// "Missing Email not in Profile URL": {
// ExistingSession: &sessions.SessionState{
// User: "missing.email",
// Groups: []string{"already", "populated"},
// IDToken: idToken,
// AccessToken: accessToken,
// RefreshToken: refreshToken,
// },
// EmailClaim: "email",
// GroupsClaim: "groups",
// ProfileJSON: map[string]interface{}{
// "groups": []string{"new", "thing"},
// },
// IntrospectJSON: map[string]interface{}{
// "active": true,
// },
// ExpectedError: errors.New("neither the id_token nor the profileURL set an email"),
// ExpectedSession: &sessions.SessionState{
// User: "missing.email",
// Groups: []string{"already", "populated"},
// IDToken: idToken,
// AccessToken: accessToken,
// RefreshToken: refreshToken,
// IntrospectClaims: "eyJhY3RpdmUiOnRydWV9",
// },
// },
// "Missing Groups": {
// ExistingSession: &sessions.SessionState{
// User: "already",
// Email: "already@populated.com",
// Groups: nil,
// IDToken: idToken,
// AccessToken: accessToken,
// RefreshToken: refreshToken,
// },
// EmailClaim: "email",
// GroupsClaim: "groups",
// ProfileJSON: map[string]interface{}{
// "email": "new@thing.com",
// "groups": []string{"new", "thing"},
// },
// IntrospectJSON: map[string]interface{}{
// "active": true,
// },
// ExpectedError: nil,
// ExpectedSession: &sessions.SessionState{
// User: "already",
// Email: "already@populated.com",
// Groups: []string{"new", "thing"},
// IDToken: idToken,
// AccessToken: accessToken,
// RefreshToken: refreshToken,
// IntrospectClaims: "eyJhY3RpdmUiOnRydWV9",
// },
// },
// "Missing Groups with Complex Groups in Profile URL": {
// ExistingSession: &sessions.SessionState{
// User: "already",
// Email: "already@populated.com",
// Groups: nil,
// IDToken: idToken,
// AccessToken: accessToken,
// RefreshToken: refreshToken,
// },
// EmailClaim: "email",
// GroupsClaim: "groups",
// ProfileJSON: map[string]interface{}{
// "email": "new@thing.com",
// "groups": []map[string]interface{}{
// {
// "groupId": "Admin Group Id",
// "roles": []string{"Admin"},
// },
// },
// },
// IntrospectJSON: map[string]interface{}{
// "active": true,
// },
// ExpectedError: nil,
// ExpectedSession: &sessions.SessionState{
// User: "already",
// Email: "already@populated.com",
// Groups: []string{"{\"groupId\":\"Admin Group Id\",\"roles\":[\"Admin\"]}"},
// IDToken: idToken,
// AccessToken: accessToken,
// RefreshToken: refreshToken,
// IntrospectClaims: "eyJhY3RpdmUiOnRydWV9",
// },
// },
// "Missing Groups with Singleton Complex Group in Profile URL": {
// ExistingSession: &sessions.SessionState{
// User: "already",
// Email: "already@populated.com",
// Groups: nil,
// IDToken: idToken,
// AccessToken: accessToken,
// RefreshToken: refreshToken,
// },
// EmailClaim: "email",
// GroupsClaim: "groups",
// ProfileJSON: map[string]interface{}{
// "email": "new@thing.com",
// "groups": map[string]interface{}{
// "groupId": "Admin Group Id",
// "roles": []string{"Admin"},
// },
// },
// IntrospectJSON: map[string]interface{}{
// "active": true,
// },
// ExpectedError: nil,
// ExpectedSession: &sessions.SessionState{
// User: "already",
// Email: "already@populated.com",
// Groups: []string{"{\"groupId\":\"Admin Group Id\",\"roles\":[\"Admin\"]}"},
// IDToken: idToken,
// AccessToken: accessToken,
// RefreshToken: refreshToken,
// IntrospectClaims: "eyJhY3RpdmUiOnRydWV9",
// },
// },
// "Empty Groups Claims": {
// ExistingSession: &sessions.SessionState{
// User: "already",
// Email: "already@populated.com",
// Groups: []string{},
// IDToken: idToken,
// AccessToken: accessToken,
// RefreshToken: refreshToken,
// },
// EmailClaim: "email",
// GroupsClaim: "groups",
// ProfileJSON: map[string]interface{}{
// "email": "new@thing.com",
// "groups": []string{"new", "thing"},
// },
// IntrospectJSON: map[string]interface{}{
// "active": true,
// },
// ExpectedError: nil,
// ExpectedSession: &sessions.SessionState{
// User: "already",
// Email: "already@populated.com",
// Groups: []string{},
// IDToken: idToken,
// AccessToken: accessToken,
// RefreshToken: refreshToken,
// IntrospectClaims: "eyJhY3RpdmUiOnRydWV9",
// },
// },
// "Missing Groups with Custom Claim": {
// ExistingSession: &sessions.SessionState{
// User: "already",
// Email: "already@populated.com",
// Groups: nil,
// IDToken: idToken,
// AccessToken: accessToken,
// RefreshToken: refreshToken,
// },
// EmailClaim: "email",
// GroupsClaim: "roles",
// ProfileJSON: map[string]interface{}{
// "email": "new@thing.com",
// "roles": []string{"new", "thing", "roles"},
// },
// IntrospectJSON: map[string]interface{}{
// "active": true,
// },
// ExpectedError: nil,
// ExpectedSession: &sessions.SessionState{
// User: "already",
// Email: "already@populated.com",
// Groups: []string{"new", "thing", "roles"},
// IDToken: idToken,
// AccessToken: accessToken,
// RefreshToken: refreshToken,
// IntrospectClaims: "eyJhY3RpdmUiOnRydWV9",
// },
// },
// "Missing Groups String Profile URL Response": {
// ExistingSession: &sessions.SessionState{
// User: "already",
// Email: "already@populated.com",
// Groups: nil,
// IDToken: idToken,
// AccessToken: accessToken,
// RefreshToken: refreshToken,
// },
// EmailClaim: "email",
// GroupsClaim: "groups",
// ProfileJSON: map[string]interface{}{
// "email": "new@thing.com",
// "groups": "singleton",
// },
// IntrospectJSON: map[string]interface{}{
// "active": true,
// },
// ExpectedError: nil,
// ExpectedSession: &sessions.SessionState{
// User: "already",
// Email: "already@populated.com",
// Groups: []string{"singleton"},
// IDToken: idToken,
// AccessToken: accessToken,
// RefreshToken: refreshToken,
// IntrospectClaims: "eyJhY3RpdmUiOnRydWV9",
// },
// },
// "Missing Groups in both Claims and Profile URL": {
// ExistingSession: &sessions.SessionState{
// User: "already",
// Email: "already@populated.com",
// IDToken: idToken,
// AccessToken: accessToken,
// RefreshToken: refreshToken,
// },
// EmailClaim: "email",
// GroupsClaim: "groups",
// ProfileJSON: map[string]interface{}{
// "email": "new@thing.com",
// },
// IntrospectJSON: map[string]interface{}{
// "active": true,
// },
// ExpectedError: nil,
// ExpectedSession: &sessions.SessionState{
// User: "already",
// Email: "already@populated.com",
// IDToken: idToken,
// AccessToken: accessToken,
// RefreshToken: refreshToken,
// IntrospectClaims: "eyJhY3RpdmUiOnRydWV9",
// },
// },
// "Introspection Response added in session": {
// ExistingSession: &sessions.SessionState{
// User: "already",
// Email: "already@populated.com",
// IDToken: idToken,
// AccessToken: accessToken,
// RefreshToken: refreshToken,
// },
// EmailClaim: "email",
// GroupsClaim: "groups",
// ProfileJSON: map[string]interface{}{
// "email": "new@thing.com",
// },
// IntrospectJSON: map[string]interface{}{
// "active": true,
// "exp": 1613553280,
// "iat": 1613549680,
// "sub": "00u65ah10oSUDoNd65d6",
// "aud": "0oa5t6ts1XZgPOOSA5d6",
// "iss": "https://dev.authprovider.com/oauth2/default",
// "jti": "ID.ShxppK0vysORHsr8S9GSPPRV-Dy1PFhqx3fPYwtijc0",
// "token_type": "Bearer",
// "at_hash": "_1EsbE1ZpyMOLiu-VdBTlg",
// "idp": "0oa5t8x90SALHBBk85d6",
// "auth_time": 1613549026,
// "amr": []string{"pwd"},
// },
// ExpectedError: nil,
// ExpectedSession: &sessions.SessionState{
// User: "already",
// Email: "already@populated.com",
// IDToken: idToken,
// AccessToken: accessToken,
// RefreshToken: refreshToken,
// IntrospectClaims: "eyJhY3RpdmUiOnRydWUsImFtciI6WyJwd2QiXSwiYXRfaGFzaCI6Il8xRXNiRTFacHlNT0xpdS1WZEJUbGciLCJhdWQiOiIwb2E1dDZ0czFYWmdQT09TQTVkNiIsImF1dGhfdGltZSI6MTYxMzU0OTAyNiwiZXhwIjoxNjEzNTUzMjgwLCJpYXQiOjE2MTM1NDk2ODAsImlkcCI6IjBvYTV0OHg5MFNBTEhCQms4NWQ2IiwiaXNzIjoiaHR0cHM6Ly9kZXYuYXV0aHByb3ZpZGVyLmNvbS9vYXV0aDIvZGVmYXVsdCIsImp0aSI6IklELlNoeHBwSzB2eXNPUkhzcjhTOUdTUFBSVi1EeTFQRmhxeDNmUFl3dGlqYzAiLCJzdWIiOiIwMHU2NWFoMTBvU1VEb05kNjVkNiIsInRva2VuX3R5cGUiOiJCZWFyZXIifQ==",
// },
// },
// }
// for testName, tc := range testCases {
// t.Run(testName, func(t *testing.T) {
// profileJSON, err := json.Marshal(tc.ProfileJSON)
// assert.NoError(t, err)
// introspectJSON, err := json.Marshal(tc.IntrospectJSON)
// assert.NoError(t, err)
// server, provider := newTestOIDCSetup([]byte(`{}`), profileJSON, introspectJSON)
// assert.NoError(t, err)
// provider.EmailClaim = tc.EmailClaim
// provider.GroupsClaim = tc.GroupsClaim
// defer server.Close()
// err = provider.EnrichSession(context.Background(), tc.ExistingSession)
// assert.Equal(t, tc.ExpectedError, err)
// assert.Equal(t, *tc.ExpectedSession, *tc.ExistingSession)
// })
// }
// }

69
testdata/ignoredredirects.txt vendored Normal file
View File

@ -0,0 +1,69 @@
This redirects are ignored because of the IAM redirect pattern.
Relevant code.
validator.go:16 invalidRedirectRegex = regexp.MustCompile(`^[/\\](?:[\s\v]*|\.{1,2})[/\\]`)
%68%74%74%70%3a%2f%2f%67%6f%6f%67%6c%65%2e%63%6f%6d
/<>//example.com
/?url=//example.com&next=//example.com&redirect=//example.com&redir=//example.com&rurl=//example.com&redirect_uri=//example.com
/?url=/\/example.com&next=/\/example.com&redirect=/\/example.com&redirect_uri=/\/example.com
/?url=Https://example.com&next=Https://example.com&redirect=Https://example.com&redir=Https://example.com&rurl=Https://example.com&redirect_uri=Https://example.com
/%68%74%74%70%3a%2f%2f%67%6f%6f%67%6c%65%2e%63%6f%6d
/ReceiveAutoRedirect/false?desiredLocationUrl=http://xssposed.org
/http://%67%6f%6f%67%6c%65%2e%63%6f%6d
/http://example.com
/http://google.com
/http://localdomain.pw
/https:/%5cexample.com/
/https:/%5cgoogle.com/
/https:/%5clocaldomain.pw/
/https://%09/example.com
/https://%5cexample.com
/https://%5cexample.com@google.com
/https://%5cgoogle.com
/https://%5clocaldomain.pw
/https://%5cwww.whitelisteddomain.tld@google.com
/https://%5cwww.whitelisteddomain.tld@localdomain.pw
/https:///example.com/%2e%2e
/https:///example.com/%2f%2e%2e
/https:///example.com@google.com/%2f%2e%2e
/https:///google.com/%2f%2e%2e
/https:///localdomain.pw/%2f%2e%2e
/https:///www.google.com/%2f%2e%2e
/https:///www.whitelisteddomain.tld@localdomain.pw/%2f%2e%2e
/https:///www.whitelisteddomain.tld@www.google.com/%2f%2e%2e
/https://example.com
/https://example.com/
/https://example.com/%2e%2e
/https://example.com/%2e%2e%2f
/https://example.com/%2f%2e%2e
/https://example.com/%2f..
/https://example.com//
/https://example.com@google.com/
/https://example.com@google.com/%2e%2e
/https://example.com@google.com/%2f%2e%2e
/https://example.com@google.com/%2f..
/https://google.com/
/https://google.com/%2e%2e
/https://google.com/%2f%2e%2e
/https://google.com/%2f..
/https://localdomain.pw/
/https://localdomain.pw/%2e%2e
/https://localdomain.pw/%2f%2e%2e
/https://localdomain.pw/%2f..
/https://www.google.com/%2e%2e
/https://www.google.com/%2f%2e%2e
/https://www.whitelisteddomain.tld@google.com/
/https://www.whitelisteddomain.tld@google.com/%2f..
/https://www.whitelisteddomain.tld@localdomain.pw/
/https://www.whitelisteddomain.tld@localdomain.pw/%2e%2e
/https://www.whitelisteddomain.tld@localdomain.pw/%2f%2e%2e
/https://www.whitelisteddomain.tld@localdomain.pw/%2f..
/https://www.whitelisteddomain.tld@www.google.com/%2e%2e
/https://www.whitelisteddomain.tld@www.google.com/%2f%2e%2e
/example.com/%2f%2e%2e
/google.com/%2f%2e%2e
/localdomain.pw/%2f%2e%2e
/redirect?url=//example.com&next=//example.com&redirect=//example.com&redir=//example.com&rurl=//example.com&redirect_uri=//example.com
/redirect?url=/\/example.com&next=/\/example.com&redirect=/\/example.com&redir=/\/example.com&rurl=/\/example.com&redirect_uri=/\/example.com
/redirect?url=Https://example.com&next=Https://example.com&redirect=Https://example.com&redir=Https://example.com&rurl=Https://example.com&redirect_uri=Https://example.com
/x:1/:///%01javascript:alert(document.cookie)/

65
testdata/openredirects.txt vendored
View File

@ -1,7 +1,6 @@
";alert(0);//
%19Jav%09asc%09ript:https%20://www.whitelisteddomain.tld/%250Aconfirm%25281%2529
%68%74%74%70%3a%2f%2f%67%6f%6f%67%6c%65%2e%63%6f%6d
.localdomain.pw
/%09/example.com
/%09/example.com@google.com
@ -24,7 +23,6 @@
/%5clocaldomain.pw
/%5cwww.whitelisteddomain.tld@google.com
/%5cwww.whitelisteddomain.tld@localdomain.pw
/%68%74%74%70%3a%2f%2f%67%6f%6f%67%6c%65%2e%63%6f%6d
//%09/example.com
//%09/example.com@google.com
//%09/google.com
@ -237,73 +235,10 @@
//www.whitelisteddomain.tld@localdomain.pw//
//www.whitelisteddomain.tld@www.google.com/%2e%2e%2f
//www.whitelisteddomain.tld@www.google.com/%2f%2e%2e
/<>//example.com
/?url=//example.com&next=//example.com&redirect=//example.com&redir=//example.com&rurl=//example.com&redirect_uri=//example.com
/?url=/\/example.com&next=/\/example.com&redirect=/\/example.com&redirect_uri=/\/example.com
/?url=Https://example.com&next=Https://example.com&redirect=Https://example.com&redir=Https://example.com&rurl=Https://example.com&redirect_uri=Https://example.com
/ReceiveAutoRedirect/false?desiredLocationUrl=http://xssposed.org
/\/\/example.com/
/\/example.com/
/\/google.com/
/\/localdomain.pw/
/example.com/%2f%2e%2e
/google.com/%2f%2e%2e
/http://%67%6f%6f%67%6c%65%2e%63%6f%6d
/http://example.com
/http://google.com
/http://localdomain.pw
/https:/%5cexample.com/
/https:/%5cgoogle.com/
/https:/%5clocaldomain.pw/
/https://%09/example.com
/https://%5cexample.com
/https://%5cexample.com@google.com
/https://%5cgoogle.com
/https://%5clocaldomain.pw
/https://%5cwww.whitelisteddomain.tld@google.com
/https://%5cwww.whitelisteddomain.tld@localdomain.pw
/https:///example.com/%2e%2e
/https:///example.com/%2f%2e%2e
/https:///example.com@google.com/%2f%2e%2e
/https:///google.com/%2f%2e%2e
/https:///localdomain.pw/%2f%2e%2e
/https:///www.google.com/%2f%2e%2e
/https:///www.whitelisteddomain.tld@localdomain.pw/%2f%2e%2e
/https:///www.whitelisteddomain.tld@www.google.com/%2f%2e%2e
/https://example.com
/https://example.com/
/https://example.com/%2e%2e
/https://example.com/%2e%2e%2f
/https://example.com/%2f%2e%2e
/https://example.com/%2f..
/https://example.com//
/https://example.com@google.com/
/https://example.com@google.com/%2e%2e
/https://example.com@google.com/%2f%2e%2e
/https://example.com@google.com/%2f..
/https://google.com/
/https://google.com/%2e%2e
/https://google.com/%2f%2e%2e
/https://google.com/%2f..
/https://localdomain.pw/
/https://localdomain.pw/%2e%2e
/https://localdomain.pw/%2f%2e%2e
/https://localdomain.pw/%2f..
/https://www.google.com/%2e%2e
/https://www.google.com/%2f%2e%2e
/https://www.whitelisteddomain.tld@google.com/
/https://www.whitelisteddomain.tld@google.com/%2f..
/https://www.whitelisteddomain.tld@localdomain.pw/
/https://www.whitelisteddomain.tld@localdomain.pw/%2e%2e
/https://www.whitelisteddomain.tld@localdomain.pw/%2f%2e%2e
/https://www.whitelisteddomain.tld@localdomain.pw/%2f..
/https://www.whitelisteddomain.tld@www.google.com/%2e%2e
/https://www.whitelisteddomain.tld@www.google.com/%2f%2e%2e
/localdomain.pw/%2f%2e%2e
/redirect?url=//example.com&next=//example.com&redirect=//example.com&redir=//example.com&rurl=//example.com&redirect_uri=//example.com
/redirect?url=/\/example.com&next=/\/example.com&redirect=/\/example.com&redir=/\/example.com&rurl=/\/example.com&redirect_uri=/\/example.com
/redirect?url=Https://example.com&next=Https://example.com&redirect=Https://example.com&redir=Https://example.com&rurl=Https://example.com&redirect_uri=Https://example.com
/x:1/:///%01javascript:alert(document.cookie)/
<>//google.com
<>//localdomain.pw
<>javascript:alert(1);