golem15/sm-seo-plugin
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: image and URL references refuse a /\ path, which browsers read as another host (WR-20)

Browse Source 
safeImageURL and ValidURLRef refused only //, so a stored og_image of
/\evil.example/x.png loaded a third-party image in the admin. Both now
refuse /\ like models.validTarget already does.
This commit is contained in:
Jakub Zych
2026-10-27 15:38:56 +01:00
parent d8aa989dfc
commit 882d4ee05f
5 changed files with 59 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
classes/field_types.go
View File

@@ -152,14 +152,15 @@ func decodeImage(_ context.Context, in pact.FormFieldValue) (pact.FormFieldDecod
return pact.FormFieldDecoded{Value: s}, nil
}
// ValidURLRef reports whether v is a path ("/x", not "//x") or an absolute
// http(s) URL with a host, without spaces or control characters.
// ValidURLRef reports whether v is a path ("/x", not "//x" or "/\x",
// which browsers read as another host) or an absolute http(s) URL with a
// host, without spaces or control characters.
func ValidURLRef(v string) bool {
if v == "" || strings.ContainsFunc(v, func(r rune) bool { return r <= ' ' || r == 0x7f }) {
return false
}
if strings.HasPrefix(v, "/") {
return !strings.HasPrefix(v, "//")
return !strings.HasPrefix(v, "//") && !strings.HasPrefix(v, `/\`)
}
u, err := url.Parse(v)
return err == nil && (u.Scheme == "http" || u.Scheme == "https") && u.Host != ""