[js-embedded-discovery] branch master updated: EDS-83 Add whitelist for return URLs

[Rod Widdowson]

This is an automated email from the git hooks/post-receive script.

rdw pushed a commit to branch master
in repository js-embedded-discovery.

View the commit online:
http://git.shibboleth.net/view/?p=js-embedded-discovery.git;a=commit;h=8f8668004948272a8fcc421a993c9121cb369df3

The following commit(s) were added to refs/heads/master by this push:
       new  8f86680   EDS-83 Add whitelist for return URLs
8f86680 is described below

commit 8f8668004948272a8fcc421a993c9121cb369df3
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Thu Jan 24 16:02:56 2019 +0000

    EDS-83 Add whitelist for return URLs
    
    https://issues.shibboleth.net/jira/browse/EDS-83
---
 src/javascript/idpselect.js           | 23 +++++++++++++++++++++++
 src/javascript/idpselect_config.js    |  1 +
 src/javascript/idpselect_languages.js |  3 ++-
 3 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/src/javascript/idpselect.js b/src/javascript/idpselect.js
index 6f355a4..476515e 100644
--- a/src/javascript/idpselect.js
+++ b/src/javascript/idpselect.js
@@ -337,6 +337,10 @@ function IdPSelectUI() {
             fatal(getLocalizedMessage('fatal.badProtocol'));
             return false;
         }
+        if (!validateReturn(paramsSupplied.returnWhiteList, returnString)) {
+            fatal(getLocalizedMessage('fatal.badReturnString'));
+            return false;
+        }
 
         //
         // isPassive
@@ -447,6 +451,25 @@ function IdPSelectUI() {
     };
 
     /**
+     * Validate the return String against the regexps
+     */
+
+    var validateReturn = function(regexps, testString) {
+        if (null == regexps) {
+            return false;
+        }
+
+        // use .length in case regexps isnt an array
+        for (var i = 0; i < regexps.length; i++) {
+            var regexp = new RegExp(regexps[i]);
+            if (regexp.test(testString)) {
+                return true;
+            }
+        }
+        return false;
+    };
+
+    /**
      * We need to cache bust on IE.  So how do we know?  Use a bigger hammer.
      */
     var isIE = function() {
diff --git a/src/javascript/idpselect_config.js b/src/javascript/idpselect_config.js
index 90ac048..f425219 100644
--- a/src/javascript/idpselect_config.js
+++ b/src/javascript/idpselect_config.js
@@ -14,6 +14,7 @@ function IdPSelectUIParms(){
                                      // Approaching via the Discovery Protocol for example
     //this.defaultReturn = "https://example.org/Shibboleth.sso/DS?SAMLDS=1&target=https://example.org/secure";
     this.defaultReturnIDParam = null;
+    this.returnWhiteList = [ "^https:\/\/example\.org\/Shibboleth\.sso\/Login.*$" , "^https:\/\/example\.com\/Shibboleth\.sso\/Login.*$" ];
     this.helpURL = 'https://wiki.shibboleth.net/confluence/display/SHIB2/DSRoadmap';
     this.ie6Hack = null;             // An array of structures to disable when drawing the pull down (needed to 
                                      // handle the ie6 z axis problem
diff --git a/src/javascript/idpselect_languages.js b/src/javascript/idpselect_languages.js
index 6041f06..4cb049a 100644
--- a/src/javascript/idpselect_languages.js
+++ b/src/javascript/idpselect_languages.js
@@ -14,7 +14,8 @@ function IdPSelectLanguages(){
         'fatal.loadFailed': 'Failed to download metadata from ',
         'fatal.noparms' : 'No parameters to discovery session and no defaultReturn parameter configured',
         'fatal.noReturnURL' : "No URL return parameter provided",
-        'fatal.badProtocol' : "Return request must start with https:// or http://",
+        'fatal.badProtocol' : "Return parameter must start with https:// or http://",
+        'fatal.badReturnString' : "Return parameter is not whitelisted",
         'idpPreferred.label': 'Use a suggested selection:',
         'idpEntry.label': 'Or enter your organization\'s name',
         'idpEntry.NoPreferred.label': 'Enter your organization\'s name',

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.