From 6f46fb81318b943593b7b5c863b13bf5cb2afce0 Mon Sep 17 00:00:00 2001
From: Kosiorkosa47 <mkosiorek121@gmail.com>
Date: Thu, 21 May 2026 15:23:27 +0000
Subject: [PATCH] Tighten UNSAFE_PATH_PATTERN against encoded path-traversal terminators (#49000)
---
src/main/java/org/keycloak/protocol/cas/utils/RedirectUtils.java | 8 ++++++--
1 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/src/main/java/org/keycloak/protocol/cas/utils/RedirectUtils.java b/src/main/java/org/keycloak/protocol/cas/utils/RedirectUtils.java
index 4e4ad6a..51432b1 100644
--- a/src/main/java/org/keycloak/protocol/cas/utils/RedirectUtils.java
+++ b/src/main/java/org/keycloak/protocol/cas/utils/RedirectUtils.java
@@ -150,12 +150,16 @@
}
// any access to parent folder /../ is unsafe with or without encoding
+ // <sep> = / | %2F | %5C | \
+ // <dots> = "..", including %2E and %252E (double-encoded) variants
+ // <terminator> = / | %2F | %5C | \ | ; | %3B | %09 | %0A | %0D | %00 | end-of-input
private final static Pattern UNSAFE_PATH_PATTERN = Pattern.compile(
- "(/|%2[fF]|%5[cC]|\\\\)(%2[eE]|\\.){2}(/|%2[fF]|%5[cC]|\\\\|;)|(/|%2[fF]|%5[cC]|\\\\)(%2[eE]|\\.){2}$");
+ "(/|%2[fF]|%5[cC]|\\\\)(%2[eE]|%252[eE]|\\.){2}(/|%2[fF]|%5[cC]|\\\\|;|%3[bB]|%09|%0[aAdD]|%00|$)");
private static boolean areWildcardsAllowed(URI redirectUri) {
- // wildcars are only allowed if no user-info and no unsafe pattern in path
+ // wildcars are only allowed if no user-info and no unparsed authority and no unsafe pattern in path
return redirectUri.getRawUserInfo() == null
+ && !(redirectUri.getRawAuthority() != null && redirectUri.getRawUserInfo() == null && redirectUri.getHost() == null && redirectUri.getPort() == -1)
&& (redirectUri.getRawPath() == null || !UNSAFE_PATH_PATTERN.matcher(redirectUri.getRawPath()).find());
}
--
Gitblit v1.10.0