From 368d47e38f6f5a02150b16b20b8969d001f28171 Mon Sep 17 00:00:00 2001
From: Ricardo Martin <rmartinc@redhat.com>
Date: Wed, 20 May 2026 05:50:38 +0000
Subject: [PATCH] Wildcards should not be allowed if authority cannot be parsed (#607) (#49130)
---
src/main/java/org/keycloak/protocol/cas/utils/RedirectUtils.java | 3 ++-
1 files changed, 2 insertions(+), 1 deletions(-)
diff --git a/src/main/java/org/keycloak/protocol/cas/utils/RedirectUtils.java b/src/main/java/org/keycloak/protocol/cas/utils/RedirectUtils.java
index 4e4ad6a..d0d64ca 100644
--- a/src/main/java/org/keycloak/protocol/cas/utils/RedirectUtils.java
+++ b/src/main/java/org/keycloak/protocol/cas/utils/RedirectUtils.java
@@ -154,8 +154,9 @@
"(/|%2[fF]|%5[cC]|\\\\)(%2[eE]|\\.){2}(/|%2[fF]|%5[cC]|\\\\|;)|(/|%2[fF]|%5[cC]|\\\\)(%2[eE]|\\.){2}$");
private static boolean areWildcardsAllowed(URI redirectUri) {
- // wildcars are only allowed if no user-info and no unsafe pattern in path
+ // wildcars are only allowed if no user-info and no unparsed authority and no unsafe pattern in path
return redirectUri.getRawUserInfo() == null
+ && !(redirectUri.getRawAuthority() != null && redirectUri.getRawUserInfo() == null && redirectUri.getHost() == null && redirectUri.getPort() == -1)
&& (redirectUri.getRawPath() == null || !UNSAFE_PATH_PATTERN.matcher(redirectUri.getRawPath()).find());
}
--
Gitblit v1.10.0