fix(site/src): prevent protocol-relative login redirects - #27363
Merged
ThomasK33 merged 2 commits intoAug 10, 2026
Merged
Conversation
Re-parse sanitized redirect paths against the deployment origin before returning them. This rejects encoded and normalized paths that would be interpreted as protocol-relative URLs when assigned to location.href. Add utility and LoginPage regression coverage for Cure53 CDM-02-001, including the reported encoded-slash PoC and related normalization variants. Sanitize the React Router navigation sink as defense in depth. --- _Generated with [`mux`](https://github.com/coder/mux) • Model: `anthropic:claude-mythos-5` • Thinking: `max`_
…te-cdm-02-001-login-redirect-sanitization-bypass
Member
Author
|
Reopened after the stale-bot auto-close and brought the branch up to date with Revalidation on the updated branch (main @ cfeae56):
Also re-verified Generated with |
ThomasK33
marked this pull request as ready for review
August 10, 2026 12:34
ibetitsmike
approved these changes
Aug 10, 2026
ThomasK33
deleted the
tk/codagt-783-remediate-cdm-02-001-login-redirect-sanitization-bypass
branch
August 10, 2026 13:35
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Hardens
sanitizeRedirectinsite/src/utils/redirect.tsagainst open redirects and adds regression coverage for Cure53 finding CDM-02-001 (coder/security-disclosures#164), a bypass of the prior fix for GHSA-wcx9-ccpj-hx3c.Problem
sanitizeRedirectreturnedURL.pathname + URL.searchand assumed a pathname is always a safe same-origin relative path. A parsed URL's pathname can itself start with//(via a percent-encoded slash, backslashes, or dot-segment normalization), and a string starting with//is a protocol-relative URL when assigned tolocation.href. The reported PoC/login?redirect=https://cure53.de/%2fcure53.dedecodes once inretrieveRedirect, yields pathname//cure53.de, and redirects a password-authenticating user to an attacker origin. A dot-segment variant (redirect=/api/v2/../../..//evil.com) also passed the/api/v2prefix check and redirected already-signed-in users on page load.Fix
sanitizeRedirectnow re-parses the candidatepathname + searchagainstlocation.originand falls back to/whenever the result would resolve to a different origin (verify-after-build instead of enumerating bad shapes). Unparsable URLs also fall back to/instead of throwing.<Navigate>fallback inLoginPagenow goes throughsanitizeRedirectas defense in depth././/evil.com, tab stripping, dot-segment traversal, pinned already-safe shapes, invalid URLs) plus a LoginPage component test driving the full PoC through password sign-in.Verification
pnpm test src/utils/redirect.test.ts src/pages/LoginPage/LoginPage.test.tsx: 23/23 passing on the rebased branch.pnpm checkand fullpnpm lint(Biome, tsc, circular deps, React compiler, knip): clean.?redirect=https://cure53.de/%2fcure53.deafter password login lands on/(same origin), nevercure53.de.?redirect=/api/v2/../../..//evil.comlands on/, neverevil.com.?redirect=/workspacesstill reaches/workspacesafter login.Refs: CODAGT-783, coder/security-disclosures#164, coder/security-disclosures#164
Generated with
mux• Model:anthropic:claude-fable-5• Thinking:max