Merge pull request #615 from namecheap/fix/redirect-vulnerability

fix: correct redirect with multiple slashes when locale is in play
namecheap · Oct 7, 2024 · 1f7440e · 1f7440e
2 parents 5e0b813 + 794c77a
commit 1f7440e
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 6 deletions.
diff --git a/ilc/common/UrlProcessor.js b/ilc/common/UrlProcessor.js
@@ -34,24 +34,24 @@ class UrlProcessor {
         }
 
         const parsedUrl = new URL(url, this.#fakeBaseInCasesWhereUrlIsRelative);
+
+        // Ensure there are no double slashes in the pathname, excluding the start
+        parsedUrl.pathname = parsedUrl.pathname.replace(/\/{2,}/g, '/');
+
         const doesUrlPathnameEndWithTrailingSlash = parsedUrl.pathname[parsedUrl.pathname.length - 1] === '/';
 
         switch (this.#trailingSlash) {
             case UrlProcessor.routerHasTo.redirectToNonTrailingSlash: {
                 if (doesUrlPathnameEndWithTrailingSlash) {
                     parsedUrl.pathname = parsedUrl.pathname.slice(0, -1);
-                    break;
-                } else {
-                    return url;
                 }
+                break;
             }
             case UrlProcessor.routerHasTo.redirectToTrailingSlash: {
                 if (!doesUrlPathnameEndWithTrailingSlash) {
                     parsedUrl.pathname = parsedUrl.pathname.concat('/');
-                    break;
-                } else {
-                    return url;
                 }
+                break;
             }
         }
         return parsedUrl.toString().replace(this.#fakeBaseInCasesWhereUrlIsRelative, '');

diff --git a/ilc/common/UrlProcessor.spec.js b/ilc/common/UrlProcessor.spec.js
@@ -132,6 +132,18 @@ describe('UrlProcessor', () => {
                 });
             });
 
+            it('when the path contains locale with multiple trailing slashes', () => {
+                const urlProcessor = new UrlProcessor(UrlProcessor.routerHasTo.redirectToTrailingSlash);
+
+                const malformedUrl = '/de///google.com/';
+                const expectedFixedUrl = '/de/google.com/';
+
+                chai.expect(urlProcessor.process(malformedUrl)).to.be.equal(
+                    expectedFixedUrl,
+                    `Failed for input: ${malformedUrl}`,
+                );
+            });
+
             it('when the original provided URL does not have origin', () => {
                 chai.expect(
                     new UrlProcessor(UrlProcessor.routerHasTo.redirectToTrailingSlash).process(