File tornado-fix-an-open-redirect-in-staticfilehandl... of Package salt.35895

Overview Repositories Revisions Requests Users Attributes Meta

File tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch of Package salt.35895

From 78f5a76315891168d24e923d2b08211baefefb4f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pablo=20Su=C3=A1rez=20Hern=C3=A1ndez?=
 <psuarezhernandez@suse.com>
Date: Thu, 22 Jun 2023 16:36:20 +0100
Subject: [PATCH] tornado: Fix an open redirect in StaticFileHandler
 (CVE-2023-28370, bsc#1211741) (#583)

---
 salt/ext/tornado/web.py | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/salt/ext/tornado/web.py b/salt/ext/tornado/web.py
index 60bde695d3..97fadcf87d 100644
--- a/salt/ext/tornado/web.py
+++ b/salt/ext/tornado/web.py
@@ -2544,6 +2544,15 @@ class StaticFileHandler(RequestHandler):
             # but there is some prefix to the path that was already
             # trimmed by the routing
             if not self.request.path.endswith("/"):
+                if self.request.path.startswith("//"):
+                    # A redirect with two initial slashes is a "protocol-relative" URL.
+                    # This means the next path segment is treated as a hostname instead
+                    # of a part of the path, making this effectively an open redirect.
+                    # Reject paths starting with two slashes to prevent this.
+                    # This is only reachable under certain configurations.
+                    raise HTTPError(
+                        403, "cannot redirect path with two initial slashes"
+                    )
                 self.redirect(self.request.path + "/", permanent=True)
                 return
             absolute_path = os.path.join(absolute_path, self.default_filename)
-- 
2.41.0

Places

File tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch of Package salt.35895

Places