Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[PM-3561] Clean the return url of any whitespace #3696

Merged
merged 5 commits into from
Feb 6, 2024
Merged

Conversation

kspearrin
Copy link
Member

Type of change

- [x] Bug fix
- [ ] New feature development
- [ ] Tech debt (refactoring, code cleanup, dependency upgrades, etc)
- [ ] Build/deploy pipeline (DevOps)
- [ ] Other

Objective

Resolves potential security issues related to whitespace allowing open redirects with the SSO return URL.

Code changes

  • AccountController.cs: Clean the return url of any whitespace characters, such as space and tab.

Before you submit

  • Please check for formatting errors (dotnet format --verify-no-changes) (required)
  • If making database changes - make sure you also update Entity Framework queries and/or migrations
  • Please add unit tests where it makes sense to do so (encouraged but not required)
  • If this change requires a documentation update - notify the documentation team
  • If this change has particular deployment requirements - notify the DevOps team

@kspearrin kspearrin marked this pull request as ready for review January 23, 2024 22:17
@kspearrin kspearrin requested a review from a team as a code owner January 23, 2024 22:17
@kspearrin kspearrin requested a review from rr-bw January 23, 2024 22:17
Copy link

codecov bot commented Jan 23, 2024

Codecov Report

Attention: 3 lines in your changes are missing coverage. Please review.

Comparison is base (88befc3) 0.00% compared to head (ed68f9a) 32.56%.

❗ Current head ed68f9a differs from pull request most recent head c22d52f. Consider uploading reports for the commit c22d52f to get more accurate results

Files Patch % Lines
test/Core.Test/Utilities/CoreHelpersTests.cs 0.00% 3 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff            @@
##           main    #3696       +/-   ##
=========================================
+ Coverage      0   32.56%   +32.56%     
=========================================
  Files         0     1213     +1213     
  Lines         0    63480    +63480     
  Branches      0     4780     +4780     
=========================================
+ Hits          0    20674    +20674     
- Misses        0    41843    +41843     
- Partials      0      963      +963     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

Copy link
Contributor

@ike-kottlowski ike-kottlowski left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One question about other whitespace encodings.

bitwarden_license/src/Sso/Controllers/AccountController.cs Outdated Show resolved Hide resolved
@rr-bw rr-bw removed their request for review January 23, 2024 23:06
@bitwarden-bot
Copy link

bitwarden-bot commented Jan 24, 2024

Logo
Checkmarx One – Scan Summary & Detailsf6144430-a98a-473a-83b4-218ade49449d

No New Or Fixed Issues Found

withinfocus
withinfocus previously approved these changes Jan 24, 2024
Copy link
Contributor

@withinfocus withinfocus left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Solid, but maybe throw in some tests.

src/Core/Utilities/CoreHelpers.cs Show resolved Hide resolved
ike-kottlowski
ike-kottlowski previously approved these changes Jan 24, 2024
@kspearrin kspearrin merged commit fc1d7c7 into main Feb 6, 2024
45 checks passed
@kspearrin kspearrin deleted the returnurlclean branch February 6, 2024 18:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants