tinyhttp / tinyhttp / 29658001347

99%

push

github

fix(res): encode authority backslash to prevent open redirect (GHSA-8q4p-mhxr-fq83) (#514)

setLocationHeader split the Location value into an unencoded scheme+host
head and an encodeUrl'd tail, but used pos = match[0].length + 1. The +1
pushed the delimiter immediately after the host — a backslash in
'https://evil.com\@trusted.com' — into the *unencoded* head, so it was
emitted raw. Parsers that treat '\' like '/' resolve that authority to
'evil.com', so a redirect allowlist checking the string sees
'evil.com...' while the browser may navigate to the attacker host: an
open redirect. Express encodes the backslash to %5C; tinyhttp did not.

Drop the +1 so the split point is exactly the end of the authority. Any
delimiter the host regex stops on (\, /, ?, #) now falls into the
encoded portion, so an authority backslash becomes %5C while the real
host is still left verbatim for allowlist checks.

Regression: introduced in 2.2.11 (dd51147, 'harden redirect location
handling'); 2.2.10 and earlier encoded the whole URL and were not
affected.

Updates two tests that had pinned the vulnerable raw-backslash output and
adds coverage for scheme-relative URLs and the res.redirect() entry point.

1013 of 1022 branches covered (99.12%)

Branch coverage included in aggregate %.

1 of 1 new or added line in 1 file covered. (100.0%)

1322 of 1325 relevant lines covered (99.77%)

176.05 hits per line