Explorar o código

PR346 [core] Default regex tightened to address open URL redirection

Issue CVE-2015-8094
alphaskade %!s(int64=9) %!d(string=hai) anos
pai
achega
cc1edfe

+ 1 - 1
desktop/conf.dist/hue.ini

@@ -134,7 +134,7 @@
   # Comma-separated list of regular expressions, which match the redirect URL.
   # For example, to restrict to your local domain and FQDN, the following value can be used:
   # ^\/.*$,^http:\/\/www.mydomain.com\/.*$
-  ## redirect_whitelist=^\/.*$
+  ## redirect_whitelist=^(\/[a-zA-Z0-9]+.*|\/)$
 
   # Comma separated list of apps to not load at server startup.
   # e.g.: pig,zookeeper

+ 1 - 1
desktop/conf/pseudo-distributed.ini.tmpl

@@ -138,7 +138,7 @@
   # Comma-separated list of regular expressions, which match the redirect URL.
   # For example, to restrict to your local domain and FQDN, the following value can be used:
   # ^\/.*$,^http:\/\/www.mydomain.com\/.*$
-  ## redirect_whitelist=^\/.*$
+  ## redirect_whitelist=^(\/[a-zA-Z0-9]+.*|\/)$
 
   # Comma separated list of apps to not load at server startup.
   # e.g.: pig,zookeeper

+ 1 - 1
desktop/core/src/desktop/conf.py

@@ -295,7 +295,7 @@ REDIRECT_WHITELIST = Config(
          "For example, to restrict to your local domain and FQDN, the following value can be used:"
          "  ^\/.*$,^http:\/\/www.mydomain.com\/.*$"),
   type=list_of_compiled_res(skip_empty=True),
-  default='^\/.*$')
+  default='^(\/[a-zA-Z0-9]+.*|\/)$')
 
 USE_X_FORWARDED_HOST = Config(
   key="use_x_forwarded_host",