Skip to content

Commit

Permalink
validate server path param for login redirect
Browse files Browse the repository at this point in the history
  • Loading branch information
@floribe2000
floribe2000 committed Jul 16, 2023
1 parent 64c21f9 commit bd73f2e
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion WoWsShipBuilder.Web/Features/Authentication/AuthController.cs
View file
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,7 @@ public Task<ActionResult> AuthenticationCanceled(string status, string message,
return Task.FromResult<ActionResult>(Redirect("/"));
}

[HttpGet("login/{server}")]
[HttpGet("login/{server:regex(^eu|asia|com$):required}")]
public Task<ActionResult> Login(string server)
{
string baseUrl = $"{Request.Scheme}://{Request.Host}{Request.PathBase}";
Expand Down

1 comment on commit bd73f2e

@loris-s-sonarsource
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hello @floribe2000, heads-up that this change does not fix the open redirect that SonarCloud told you:

^eu|asia|com$ translates to:

  • Does the string start with eu?
  • OR does the string contain asia?
  • OR does the string end with com?

The actual regex you want is ^(eu|asia|com)$ instead, if you want to restrict the full string to these three words.

Please sign in to comment.