- For security reasons, LabKey Server restricts the host names that can be used in returnUrl parameters.
+ For security reasons, external redirects are restricted to the host names in this list.
By default, only redirects to the same LabKey instance are allowed.
- Other server host names must be configured below to allow them to be automatically redirected.
+ Other server host names must be configured below to allow redirects to them.
For more information on the security concern, please refer to the
- OWASP cheat sheet.
+ OWASP cheat sheet.
- Add allowed hosts based on the server name or IP address, as they will be referenced in returnUrl values.
- For example: www.myexternalhost.com or 1.2.3.4
+ Add allowed hosts based on the server name or IP address, as they will be referenced in parameters
+ such as returnUrl. An asterisk (*) follow by a dot acts as a wild card that matches any leading
+ subdomain for that host.
+ Examples: www.myexternalhost.com, *.myexternalhost.com, or 1.2.3.4
""");
@@ -69,9 +71,32 @@ public void validateValueFormat(String host, BindException errors)
{
errors.addError(new LabKeyError("Redirect host name must not be blank."));
}
- else if (!AUTHORITY_VALIDATOR.isValidAuthority(host))
+ else
{
- errors.addError(new LabKeyError(String.format("Redirect host name %1$s is not formatted correctly", host)));
+ if (AUTHORITY_VALIDATOR.isValidAuthority(host))
+ {
+ // Validate wild card patterns
+ int starCount = StringUtils.countMatches(host, '*');
+ if (starCount > 0)
+ {
+ if (starCount > 1)
+ {
+ errors.addError(new LabKeyError(String.format("Redirect host name %1$s has multiple wild card characters", host)));
+ }
+ else if (!host.startsWith("*."))
+ {
+ errors.addError(new LabKeyError(String.format("Redirect host name %1$s has an invalid wild card. The pattern must start with \"*.\".", host)));
+ }
+ else if (StringUtils.countMatches(host, '.') < 2)
+ {
+ errors.addError(new LabKeyError(String.format("Redirect host name %1$s with wild card is too short. The pattern must include at least two dots.", host)));
+ }
+ }
+ }
+ else
+ {
+ errors.addError(new LabKeyError(String.format("Redirect host name %1$s is not a valid host name", host)));
+ }
}
}
diff --git a/core/src/org/labkey/core/login/LoginController.java b/core/src/org/labkey/core/login/LoginController.java
index fe5650b8808..b47c07af6a7 100644
--- a/core/src/org/labkey/core/login/LoginController.java
+++ b/core/src/org/labkey/core/login/LoginController.java
@@ -103,6 +103,7 @@
import org.labkey.api.util.logging.LogHelper;
import org.labkey.api.view.ActionURL;
import org.labkey.api.view.BadRequestException;
+import org.labkey.api.view.ExternalRedirectException;
import org.labkey.api.view.HtmlView;
import org.labkey.api.view.HttpView;
import org.labkey.api.view.JspView;
@@ -110,6 +111,7 @@
import org.labkey.api.view.NavTree;
import org.labkey.api.view.NotFoundException;
import org.labkey.api.view.RedirectException;
+import org.labkey.api.view.UnsafeExternalRedirectException;
import org.labkey.api.view.VBox;
import org.labkey.api.view.WebPartView;
import org.labkey.api.view.template.PageConfig;
@@ -121,7 +123,6 @@
import org.springframework.web.servlet.ModelAndView;
import org.springframework.web.servlet.mvc.Controller;
-import java.io.IOException;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Comparator;
@@ -586,7 +587,7 @@ private ModelAndView redirectIfLoggedIn(AbstractLoginForm form)
LoginReturnProperties properties = null != returnUrl || form.getSkipProfile()
? new LoginReturnProperties(returnUrl, form.getUrlhash(), form.getSkipProfile()) : null;
- return HttpView.redirect(AuthenticationManager.getAfterLoginURL(getContainer(), properties, getUser()), true);
+ throw new ExternalRedirectException(AuthenticationManager.getAfterLoginURL(getContainer(), properties, getUser()));
}
return null;
}
@@ -1431,15 +1432,9 @@ public URLHelper getSuccessURL(ReturnUrlForm form)
{
if (null != _redirectURL)
{
- try
- {
- getViewContext().getResponse().sendRedirect(_redirectURL.getURIString());
- return null;
- }
- catch (IOException e)
- {
- throw new RuntimeException(e);
- }
+ // It's safe to bypass checking the external redirect allow list in this case because we are redirecting
+ // to the administrator-provided URL from the SSO authentication configuration (e.g., CAS logout).
+ throw new UnsafeExternalRedirectException(_redirectURL);
}
return form.getReturnUrlHelper(AuthenticationManager.getWelcomeURL());
}
@@ -1562,19 +1557,18 @@ public ModelAndView getView(SsoRedirectForm form, BindException errors)
AuthenticationManager.setLoginReturnProperties(getViewContext().getRequest(), properties);
}
- String csrf = CSRFUtil.getExpectedToken(getViewContext());
-
final URLHelper url;
int rowId = form.getConfiguration();
-
SSOAuthenticationConfiguration configuration = AuthenticationManager.getActiveSSOConfiguration(rowId);
if (null == configuration)
throw new NotFoundException("Authentication configuration is not valid");
- url = configuration.getUrl(csrf, getViewContext());
+ url = configuration.getUrl(getViewContext());
- return HttpView.redirect(url, true);
+ // It's safe to bypass checking the external redirect allow list in this case because we are redirecting to
+ // the administrator-provided URL from the SSO authentication configuration.
+ throw new UnsafeExternalRedirectException(url);
}
@Override
@@ -1777,7 +1771,7 @@ public ModelAndView getSuccessView(SetPasswordForm form)
_successUrl = AppProps.getInstance().getHomePageActionURL();
// Issue 33599: allow the returnUrl for this action to redirect to an absolute URL (ex. labkey.org back to accounts.trial.labkey.host)
- return HttpView.redirect(_successUrl, true);
+ throw new ExternalRedirectException(_successUrl);
}
}
diff --git a/core/src/org/labkey/core/login/termsOfUse.jsp b/core/src/org/labkey/core/login/termsOfUse.jsp
index 8cfa7bb0445..5face19abc0 100644
--- a/core/src/org/labkey/core/login/termsOfUse.jsp
+++ b/core/src/org/labkey/core/login/termsOfUse.jsp
@@ -42,7 +42,7 @@
// Redirect immediately if terms are blank or null
if (HtmlString.isBlank(termsHtml))
- throw new RedirectException(returnUrl, false);
+ throw new RedirectException(returnUrl);
ActionURL formURL = urlFor(AgreeToTermsAction.class);
%>
diff --git a/core/src/org/labkey/core/portal/ProjectController.java b/core/src/org/labkey/core/portal/ProjectController.java
index ff8155a00e9..e71a32e1e61 100644
--- a/core/src/org/labkey/core/portal/ProjectController.java
+++ b/core/src/org/labkey/core/portal/ProjectController.java
@@ -462,7 +462,7 @@ public void addNavTrail(NavTree root)
public static class FileBrowserAction extends org.labkey.api.action.SimpleRedirectAction