Guard against Xss in Redirect.cshtml using signin-redirect.js

alexhiggins732 · Feb 14, 2024 · 1c05069 · 1c05069
1 parent 593c3cb
commit 1c05069
Show file tree

Hide file tree

Showing 17 changed files with 63 additions and 32 deletions.
diff --git a/samples/Directory.Build.props b/samples/Directory.Build.props
@@ -12,6 +12,7 @@
   </PropertyGroup>
   <ItemGroup>
     <PackageVersion Include="HigginsSoft.IdentityServer8" Version="$(IdentityServerVersion)" />
+	<PackageVersion Include="HigginsSoft.IdentityServer8.Security" Version="$(IdentityServerVersion)" />
 	<PackageVersion Include="HigginsSoft.IdentityServer8.AspNetIdentity" Version="$(IdentityServerVersion)" />
     <PackageVersion Include="HigginsSoft.IdentityServer8.EntityFramework" Version="$(IdentityServerVersion)" />
   </ItemGroup>

diff --git a/samples/Quickstarts/2_InteractiveAspNetCore/src/IdentityServer/IdentityServer.csproj b/samples/Quickstarts/2_InteractiveAspNetCore/src/IdentityServer/IdentityServer.csproj
@@ -1,6 +1,7 @@
-<Project Sdk="Microsoft.NET.Sdk.Web">
+<Project Sdk="Microsoft.NET.Sdk.Web">
   <ItemGroup>
     <PackageReference Include="HigginsSoft.IdentityServer8" />
+    <PackageReference Include="HigginsSoft.IdentityServer8.Security" />
     <PackageReference Include="Microsoft.Web.LibraryManager.Build" />
     <PackageReference Include="Serilog.AspNetCore" />  
     <PackageReference Include="Microsoft.AspNetCore.Authentication.Google" />

diff --git a/samples/Quickstarts/2_InteractiveAspNetCore/src/IdentityServer/Views/Shared/Redirect.cshtml b/samples/Quickstarts/2_InteractiveAspNetCore/src/IdentityServer/Views/Shared/Redirect.cshtml
@@ -1,5 +1,5 @@
 @model RedirectViewModel
-
+@using Microsoft.DependencyInjection.Extensions;
 <div class="redirect-page">
     <div class="lead">
         <h1>You are now being returned to the application</h1>
@@ -8,4 +8,7 @@
 </div>
 
 <meta http-equiv="refresh" content="0;url=@Model.RedirectUrl" data-url="@Model.RedirectUrl">
-<script src="~/js/signin-redirect.js"></script>
+<script>
+    var url = '@Ioc.Sanitizer.Url.Sanitize(Model.RedirectUrl)';
+    window.location.href = url;
+</script>
diff --git a/samples/Quickstarts/2_InteractiveAspNetCore/src/IdentityServer/wwwroot/js/signin-redirect.js b/samples/Quickstarts/2_InteractiveAspNetCore/src/IdentityServer/wwwroot/js/signin-redirect.js
@@ -1 +1 @@
-window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url");
+//window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url");
diff --git a/samples/Quickstarts/3_AspNetCoreAndApis/src/IdentityServer/Views/Shared/Redirect.cshtml b/samples/Quickstarts/3_AspNetCoreAndApis/src/IdentityServer/Views/Shared/Redirect.cshtml
@@ -1,5 +1,5 @@
 @model RedirectViewModel
-
+@using Microsoft.DependencyInjection.Extensions;
 <div class="redirect-page">
     <div class="lead">
         <h1>You are now being returned to the application</h1>
@@ -8,4 +8,8 @@
 </div>
 
 <meta http-equiv="refresh" content="0;url=@Model.RedirectUrl" data-url="@Model.RedirectUrl">
-<script src="~/js/signin-redirect.js"></script>
+<script>
+    var url = '@Ioc.Sanitizer.Url.Sanitize(Model.RedirectUrl)';
+    window.location.href = url;
+</script>
+
diff --git a/samples/Quickstarts/3_AspNetCoreAndApis/src/IdentityServer/wwwroot/js/signin-redirect.js b/samples/Quickstarts/3_AspNetCoreAndApis/src/IdentityServer/wwwroot/js/signin-redirect.js
@@ -1 +1 @@
-window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url");
+//window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url");
diff --git a/samples/Quickstarts/4_JavaScriptClient/src/IdentityServer/Views/Shared/Redirect.cshtml b/samples/Quickstarts/4_JavaScriptClient/src/IdentityServer/Views/Shared/Redirect.cshtml
@@ -1,5 +1,5 @@
 @model RedirectViewModel
-
+@using Microsoft.DependencyInjection.Extensions;
 <div class="redirect-page">
     <div class="lead">
         <h1>You are now being returned to the application</h1>
@@ -8,4 +8,7 @@
 </div>
 
 <meta http-equiv="refresh" content="0;url=@Model.RedirectUrl" data-url="@Model.RedirectUrl">
-<script src="~/js/signin-redirect.js"></script>
+<script>
+    var url = '@Ioc.Sanitizer.Url.Sanitize(Model.RedirectUrl)';
+    window.location.href = url;
+</script>
diff --git a/samples/Quickstarts/4_JavaScriptClient/src/IdentityServer/wwwroot/js/signin-redirect.js b/samples/Quickstarts/4_JavaScriptClient/src/IdentityServer/wwwroot/js/signin-redirect.js
@@ -1 +1 @@
-window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url");
+// window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url");
diff --git a/samples/Quickstarts/5_EntityFramework/src/IdentityServer/Views/Shared/Redirect.cshtml b/samples/Quickstarts/5_EntityFramework/src/IdentityServer/Views/Shared/Redirect.cshtml
@@ -1,5 +1,5 @@
 @model RedirectViewModel
-
+@using Microsoft.DependencyInjection.Extensions;
 <div class="redirect-page">
     <div class="lead">
         <h1>You are now being returned to the application</h1>
@@ -8,4 +8,7 @@
 </div>
 
 <meta http-equiv="refresh" content="0;url=@Model.RedirectUrl" data-url="@Model.RedirectUrl">
-<script src="~/js/signin-redirect.js"></script>
+<script>
+    var url = '@Ioc.Sanitizer.Url.Sanitize(Model.RedirectUrl)';
+    window.location.href = url;
+</script>
diff --git a/samples/Quickstarts/5_EntityFramework/src/IdentityServer/wwwroot/js/signin-redirect.js b/samples/Quickstarts/5_EntityFramework/src/IdentityServer/wwwroot/js/signin-redirect.js
@@ -1 +1 @@
-window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url");
+// window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url");
diff --git a/...uickstarts/6_AspNetIdentity/src/IdentityServerAspNetIdentity/Views/Shared/Redirect.cshtml b/...uickstarts/6_AspNetIdentity/src/IdentityServerAspNetIdentity/Views/Shared/Redirect.cshtml
@@ -1,5 +1,5 @@
 @model RedirectViewModel
-
+@using Microsoft.DependencyInjection.Extensions;
 <div class="redirect-page">
     <div class="lead">
         <h1>You are now being returned to the application</h1>
@@ -8,4 +8,7 @@
 </div>
 
 <meta http-equiv="refresh" content="0;url=@Model.RedirectUrl" data-url="@Model.RedirectUrl">
-<script src="~/js/signin-redirect.js"></script>
+<script>
+    var url = '@Ioc.Sanitizer.Url.Sanitize(Model.RedirectUrl)';
+    window.location.href = url;
+</script>
diff --git a/...ickstarts/6_AspNetIdentity/src/IdentityServerAspNetIdentity/wwwroot/js/signin-redirect.js b/...ickstarts/6_AspNetIdentity/src/IdentityServerAspNetIdentity/wwwroot/js/signin-redirect.js
@@ -1 +1 @@
-window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url");
+// window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url");
diff --git a/src/AspNetIdentity/host/Views/Shared/Redirect.cshtml b/src/AspNetIdentity/host/Views/Shared/Redirect.cshtml
@@ -1,11 +1,14 @@
 @model RedirectViewModel
-
+@using Microsoft.DependencyInjection.Extensions;
 <div class="redirect-page">
     <div class="lead">
         <h1>You are now being returned to the application</h1>
         <p>Once complete, you may close this tab.</p>
     </div>
 </div>
 
-<meta http-equiv="refresh" content="0;url=@Model.RedirectUrl" data-url="@Model.RedirectUrl">
-<script src="~/js/signin-redirect.js"></script>
+<meta http-equiv="refresh" content="0;url=@Model.RedirectUrl" data-url="@Model.RedirectUrl.SantizeForRedirect()">
+<script>
+    var url = '@Model.RedirectUrl.SanitizeForUrl()';
+    window.location.href = url;
+</script>
diff --git a/src/AspNetIdentity/host/wwwroot/js/signin-redirect.js b/src/AspNetIdentity/host/wwwroot/js/signin-redirect.js
@@ -1 +1 @@
-window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url");
+//window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url");
diff --git a/src/IdentityServer8/host/Views/Shared/Redirect.cshtml b/src/IdentityServer8/host/Views/Shared/Redirect.cshtml
@@ -1,5 +1,5 @@
 @model RedirectViewModel
-
+@using Microsoft.DependencyInjection.Extensions;
 <div class="redirect-page">
     <div class="lead">
         <h1>You are now being returned to the application</h1>
@@ -8,4 +8,7 @@
 </div>
 
 <meta http-equiv="refresh" content="0;url=@Model.RedirectUrl" data-url="@Model.RedirectUrl">
-<script src="~/js/signin-redirect.js"></script>
+<script>
+    var url = '@Model.RedirectUrl.SanitizeForUrl()';
+    window.location.href = url;
+</script>
diff --git a/src/IdentityServer8/host/wwwroot/js/signin-redirect.js b/src/IdentityServer8/host/wwwroot/js/signin-redirect.js
@@ -1 +1 @@
-window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url");
+//window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url");
diff --git a/src/Security/IdentityServer8.Security/Sanitizer.cs b/src/Security/IdentityServer8.Security/Sanitizer.cs
@@ -327,7 +327,7 @@ public Sanitizer(ISanitizerFactory sanitizerFactory)
             Log = sanitizerFactory.Create<ILogSanitizer>();
         }
 
-        
+
         public IHtmlSanitizer Html { get; }
         public IXmlSanitizer Xml { get; }
         public IJsonSanitizer Json { get; }
@@ -371,46 +371,53 @@ public static IServiceCollection AddSanitizers(this IServiceCollection services)
             return Ioc.Sanitizer.Log.Sanitize(input?.ToString(), mode);
         }
 
-        public static string? SanitizeForHtml(object? input, SanitizerMode mode = SanitizerMode.Clean)
+        public static string? SanitizeForHtml(this object? input, SanitizerMode mode = SanitizerMode.Clean)
         {
             return Ioc.Sanitizer.Html.Sanitize(input?.ToString(), mode);
         }
 
-        public static string? SanitizeForXml(object? input, SanitizerMode mode = SanitizerMode.Clean)
+        public static string? SanitizeForXml(this object? input, SanitizerMode mode = SanitizerMode.Clean)
         {
             return Ioc.Sanitizer.Xml.Sanitize(input?.ToString(), mode);
         }
 
-        public static string? SanitizeForJson(object? input, SanitizerMode mode = SanitizerMode.Clean)
+        public static string? SanitizeForJson(this object? input, SanitizerMode mode = SanitizerMode.Clean)
         {
             return Ioc.Sanitizer.Json.Sanitize(input?.ToString(), mode);
         }
 
-        public static string? SanitizeForUrl(object? input, SanitizerMode mode = SanitizerMode.Clean)
+        public static string? SanitizeForUrl(this object? input, SanitizerMode mode = SanitizerMode.Clean)
         {
             return Ioc.Sanitizer.Url.Sanitize(input?.ToString(), mode);
         }
 
-        public static string? SanitizeForCss(object? input, SanitizerMode mode = SanitizerMode.Clean)
+        public static string? SanitizeForCss(this object? input, SanitizerMode mode = SanitizerMode.Clean)
         {
             return Ioc.Sanitizer.Css.Sanitize(input?.ToString(), mode);
         }
 
-        public static string? SanitizeForScript(object? input, SanitizerMode mode = SanitizerMode.Clean)
+        public static string? SanitizeForScript(this object? input, SanitizerMode mode = SanitizerMode.Clean)
         {
             return Ioc.Sanitizer.Script.Sanitize(input?.ToString(), mode);
         }
 
-        public static string? SanitizeForStyle(object? input, SanitizerMode mode = SanitizerMode.Clean)
+        public static string? SanitizeForStyle(this object? input, SanitizerMode mode = SanitizerMode.Clean)
         {
             return Ioc.Sanitizer.Style.Sanitize(input?.ToString(), mode);
         }
 
-        public static string? SanitizeForSql(object? input, SanitizerMode mode = SanitizerMode.Clean)
+        public static string? SanitizeForSql(this object? input, SanitizerMode mode = SanitizerMode.Clean)
         {
             return Ioc.Sanitizer.Sql.Sanitize(input?.ToString(), mode);
         }
 
+        public static string? SantizeForRedirect(this object? input, SanitizerMode mode = SanitizerMode.Clean)
+        {
+            var decoded = Uri.UnescapeDataString(input?.ToString() ?? "");
+            decoded.SanitizeForHtml();
+            var escaped = Uri.EscapeDataString(decoded);
+            return escaped;
+        }
 
     }