1
84%
master: 84%

Ran 21 Apr 2026 10:58PM UTC

Files 51

Run time 1s

Badge

Embed ▾

Committed 21 Apr 2026 10:50PM UTC coverage: 84.187% (-0.06%) from 84.247%

Job # 24750714194.1

Build Type

Pull #2049

github

Committed by

paskal

Commit Message

fix(auth): close OAuth open-redirect by wiring AllowedRedirectHosts

Bump go-pkgz/auth/v2 to master (v2.1.2-0.20260421203319-686683f19cf7)
which carries the `from` redirect validator from go-pkgz/auth#275.

The library default with a nil AllowedRedirectHosts is permissive
(preserves legacy behavior for existing consumers on a dep bump), so
just bumping the dep leaves remark42 vulnerable — a crafted
/auth/<provider>/login?from=https://evil.example.com/... still issues
the 307 to the attacker host after the user completes legitimate
OAuth. Verified end-to-end against a local dev-auth instance before
and after this commit.

Wire Opts.AllowedRedirectHosts in getAuthenticator to the operator's
existing --allowed-hosts config, stripping the CSP "self" sentinel
which is not a real hostname. RemarkURL's own host is always implicit
per the library contract, so a default single-site deployment gains
the protection with no config change. Multi-host embeds work as soon
as their embedding hosts are added to AllowedHosts (they already need
to be there for CSP frame-ancestors).

Refreshed vendor tree to match the new module version.

Pull Request Pull Request #2049: fix(auth): close OAuth open-redirect by wiring AllowedRedirectHosts

Coverage Stats

6245 of 7418 relevant lines covered (84.19%)

34.32 hits per line

umputun / remark42 / 24750714194 / 1
84%
master: 84%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 24750714194.1

umputun / remark42 / 24750714194 / 1 84% master: 84%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 24750714194.1

umputun / remark42 / 24750714194 / 1
84%
master: 84%

README BADGES
x