Repository navigation
Conversation
The toggle action redirected to the Referer header verbatim, which is an open redirect. It is hard to abuse in practice, since the visitor has to already be on the referring page, but it is the kind of thing security scanners flag and there is no reason to keep it. Compare the referrer host to the request host and fall back to the shop homepage when they differ, when the referrer carries no host at all, or when it is protocol relative. Claude-Session: https://claude.ai/code/session_01P9NzuVPQGvaVR97HZFq98a
15 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ToggleVatActionredirected to theRefererheader verbatim, which is an open redirect.It is hard to actually abuse — the visitor has to already be on the referring page for it to fire — but it costs nothing to close, and it is exactly the pattern security scanners flag on a Sylius shop.
The referrer host is now compared to the request host, falling back to the shop homepage when they differ. Covered by a data provider:
https://example.com/previous-page(same host)https://evil.example/phishing//evil.example/phishing(protocol relative)https://evil.example.com/phishing(suffix of the host)''/previous-page(relative)One behaviour note: a relative referrer now falls back to the homepage rather than being followed. Browsers send absolute URLs here, so this should not come up in practice — but it is a real difference, and I chose the strict reading over adding a special case that only exists for a client nobody has. Say the word if you would rather allow relative paths through.
Addresses the second security item in #5.
https://claude.ai/code/session_01P9NzuVPQGvaVR97HZFq98a