Skip to content

Commit

Permalink
Prevent open redirects when cleanUrls config is enabled (#122)
Browse files Browse the repository at this point in the history
* Prevent open redirects when `cleanUrls` config is enabled

* Cov
  • Loading branch information
TooTallNate authored Jun 4, 2020
1 parent b0f1a62 commit 36988e8
Show file tree
Hide file tree
Showing 2 changed files with 22 additions and 10 deletions.
18 changes: 8 additions & 10 deletions src/index.js
Original file line number Diff line number Diff line change
Expand Up @@ -127,15 +127,19 @@ const shouldRedirect = (decodedPath, {redirects = [], trailingSlash}, cleanUrl)
return null;
}

let cleanedUrl = false;

// By stripping the HTML parts from the decoded
// path *before* handling the trailing slash, we make
// sure that only *one* redirect occurs if both
// config options are used.
if (cleanUrl && matchHTML.test(decodedPath)) {
decodedPath = decodedPath.replace(matchHTML, '');
cleanedUrl = true;
if (decodedPath.indexOf('//') > -1) {
decodedPath = decodedPath.replace(/\/+/g, '/');
}
return {
target: ensureSlashStart(decodedPath),
statusCode: defaultType
};
}

if (slashing) {
Expand Down Expand Up @@ -163,13 +167,6 @@ const shouldRedirect = (decodedPath, {redirects = [], trailingSlash}, cleanUrl)
}
}

if (cleanedUrl) {
return {
target: ensureSlashStart(decodedPath),
statusCode: defaultType
};
}

// This is currently the fastest way to
// iterate over an array
for (let index = 0; index < redirects.length; index++) {
Expand Down Expand Up @@ -412,6 +409,7 @@ const renderDirectory = async (current, acceptsJSON, handlers, methods, config,
return 1;
}

/* istanbul ignore next */
if (a.base < b.base) {
return -1;
}
Expand Down
14 changes: 14 additions & 0 deletions test/integration.js
Original file line number Diff line number Diff line change
Expand Up @@ -278,6 +278,20 @@ test('set `trailingSlash` config property to `false`', async t => {
t.is(location, target);
});

test('set `cleanUrls` config property should prevent open redirects', async t => {
const url = await getUrl({
cleanUrls: true
});

const response = await fetch(`${url}//haveibeenpwned.com/index`, {
redirect: 'manual',
follow: 0
});

const location = response.headers.get('location');
t.is(location, `${url}/haveibeenpwned.com`);
});

test('set `rewrites` config property to wildcard path', async t => {
const destination = '.dotfile';
const related = path.join(fixturesFull, destination);
Expand Down

0 comments on commit 36988e8

Please sign in to comment.