From 6f46fb81318b943593b7b5c863b13bf5cb2afce0 Mon Sep 17 00:00:00 2001
From: Kosiorkosa47 <mkosiorek121@gmail.com>
Date: Thu, 21 May 2026 15:23:27 +0000
Subject: [PATCH] Tighten UNSAFE_PATH_PATTERN against encoded path-traversal terminators (#49000)
---
src/main/java/org/keycloak/protocol/cas/utils/RedirectUtils.java | 5 ++++-
1 files changed, 4 insertions(+), 1 deletions(-)
diff --git a/src/main/java/org/keycloak/protocol/cas/utils/RedirectUtils.java b/src/main/java/org/keycloak/protocol/cas/utils/RedirectUtils.java
index d0d64ca..51432b1 100644
--- a/src/main/java/org/keycloak/protocol/cas/utils/RedirectUtils.java
+++ b/src/main/java/org/keycloak/protocol/cas/utils/RedirectUtils.java
@@ -150,8 +150,11 @@
}
// any access to parent folder /../ is unsafe with or without encoding
+ // <sep> = / | %2F | %5C | \
+ // <dots> = "..", including %2E and %252E (double-encoded) variants
+ // <terminator> = / | %2F | %5C | \ | ; | %3B | %09 | %0A | %0D | %00 | end-of-input
private final static Pattern UNSAFE_PATH_PATTERN = Pattern.compile(
- "(/|%2[fF]|%5[cC]|\\\\)(%2[eE]|\\.){2}(/|%2[fF]|%5[cC]|\\\\|;)|(/|%2[fF]|%5[cC]|\\\\)(%2[eE]|\\.){2}$");
+ "(/|%2[fF]|%5[cC]|\\\\)(%2[eE]|%252[eE]|\\.){2}(/|%2[fF]|%5[cC]|\\\\|;|%3[bB]|%09|%0[aAdD]|%00|$)");
private static boolean areWildcardsAllowed(URI redirectUri) {
// wildcars are only allowed if no user-info and no unparsed authority and no unsafe pattern in path
--
Gitblit v1.10.0