Attachment 859668 Details for Bug 923464 – Close header-hole, attempt #2

[patch] Close header-hole, attempt #2

0001-923464-CVE-2013-1869-close-header-injection-hole.patch (text/plain), 1.56 KB, created by Grant Gainey on 2014-02-05 13:54:33 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Grant Gainey

Created: 2014-02-05 13:54:33 UTC

Size: 1.56 KB

patch

obsolete

>From d391391881964de49b9b13414a8600884a06a8e2 Mon Sep 17 00:00:00 2001
>From: Grant Gainey <ggainey@redhat.com>
>Date: Wed, 5 Feb 2014 08:10:40 -0500
>Subject: [PATCH] 923464 - CVE-2013-1869, close header-injection hole
>
>---
> .../src/com/redhat/rhn/frontend/action/systems/OverviewAction.java   | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
>diff --git a/java/code/src/com/redhat/rhn/frontend/action/systems/OverviewAction.java b/java/code/src/com/redhat/rhn/frontend/action/systems/OverviewAction.java
>index 7837e3b..42f9beb 100644
>--- a/java/code/src/com/redhat/rhn/frontend/action/systems/OverviewAction.java
>+++ b/java/code/src/com/redhat/rhn/frontend/action/systems/OverviewAction.java
>@@ -45,7 +45,8 @@ public class OverviewAction extends RhnListAction {
>     private static final String[] ALLOWED_REDIRECTS = { "/rhn/", "/network/" };
> 
>     //
>-    // Only follow redirects if they're "inside" the app
>+    // Only follow redirects if they're "inside" the app (close open-redirecting)
>+    // Make sure to ignore anything after a <CR><LF> in the string (close header-injection)
>     //
>     private String getLegalReturnUrl(String proposedRedirect) {
>         if (proposedRedirect == null) {
>@@ -54,6 +55,8 @@ public class OverviewAction extends RhnListAction {
> 
>         for (String dest : ALLOWED_REDIRECTS) {
>             if (proposedRedirect.startsWith(dest)) {
>+                // Punt any control-characters found
>+                proposedRedirect = proposedRedirect.replaceAll("\\p{Cntrl}", "");
>                 return proposedRedirect;
>             }
>         }
>-- 
>1.8.1.4
>

Actions: View | Diff

Attachments on bug 923464: 820003 | 859232 | 859668