File Coverage

blib/lib/Mojolicious/Plugin/ClosedRedirect.pm

Criterion	Covered	Total	%
statement	75	76	98.6
branch	22	28	78.5
condition	9	14	64.2
subroutine	9	9	100.0
pod	2	2	100.0
total	117	129	90.7

package Mojolicious::Plugin::ClosedRedirect;
use Mojo::Base 'Mojolicious::Plugin';
use Mojo::ByteStream 'b';
use Mojo::Util qw/secure_compare url_unescape quote/;

our $VERSION = '0.15';

# TODO: Support domain whitelisting, like
#       https://github.com/sdsdkkk/safe_redirect
# TODO: Accept same origin URLs.
# TODO: Probably enforce full URLs to handle things like:
#       https://www.redmine.org/issues/19577

# Register plugin
sub register {
  my ($plugin, $app, $param) = @_;

  $param ||= {};

  # Load parameter from Config file
  if (my $config_param = $app->config('ClosedRedirect')) {
    $param = { %$param, %$config_param };
  };

  # Set secrets
  my $secrets;
  if ($param->{secrets} && ref $param->{secrets} eq 'ARRAY') {
    $plugin->secrets($param->{secrets});
    $secrets = $param->{secrets};
  }

  # Get secrets from application
  else {
    $secrets = $app->secrets;
  };

  my ($log, $plugins) = ($app->log, $app->plugins);

  # Establish 'close_redirect_to' helper
  $app->helper(
    close_redirect_to => sub {
      my $c = shift;

      my $url = $c->url_for(@_);

      # Delete possible 'crto' parameter
      $url->query->remove('crto');

      # Canonicalize
      $url->path->canonicalize;

      # Get the first plugin secret or the first application secret
      my $secret = $secrets->[0];

      # Calculate check
      my $url_check =
        b($url->to_string)
        ->url_unescape
        ->hmac_sha1_sum($secret);

      # Append check parameter to url
      $url->query({ crto => $url_check });
      return $url->to_string;
    }
  );

  # Redirect to relative URL
  $app->helper(
    relative_redirect_to => sub {
      my $c = shift;

      # Get the base path of the request URL
      my $path = $c->req->url->base->path->canonicalize;

      # Get URL
      my $redirect = $c->url_for(@_);

      # In case path is set, remove path prefix
      if ($path) {
        my $redirect_parts = $redirect->path->parts;
        foreach (@{$path->parts}) {
          if ($redirect_parts->[0] && ($_ eq $redirect_parts->[0])) {
            shift @$redirect_parts;
          };
        };
      };

      # Don't override 3xx status
      my $res = $c->res;
      $res->headers->location($redirect);
      return $c->rendered($res->is_redirect ? () : 302);
    }
  );

  # Add validation check
  # Alternatively make this a filter instead
  $app->validator->add_check(
    closed_redirect => sub {
      my ($v, $name, $return_url, $method) = @_;
      $method //= '';

      # No URL given
      # This is not judged as an Open Redirect attack
      return 'Redirect is missing' unless $return_url;

      my ($err, $url);

      # No array allowed
      if (ref $v->output->{$name} eq 'ARRAY') {
        $err = 'Redirect is defined multiple times';
      }

      # Parameter is fine
      else {

        # Check for local paths
        if ($method ne 'signed') {

          # That's fine
          if (_local_path($return_url)) {
            # Get url
            $url = Mojo::URL->new($return_url);

            # Remove parameter if existent
            $url->query->remove('crto');

            # Rewrite parameter
            $v->output->{$name} = $url->to_string;

            return;
          };
        };

        # Get url
        $url = Mojo::URL->new($return_url);

        # local_path not valid
        # Support signing
        unless ($method eq 'local') {

          # Get 'crto' parameter
          my $check = $url->query->param('crto');

          # No check parameter available
          if ($check) {

            # Remove parameter
            $url->query->remove('crto');

            my $url_check;

            # Check all secrets
            foreach (@$secrets) {

              # Calculate check
              $url_check =
                b($url->to_string)->
                url_unescape->
                hmac_sha1_sum($_);

              # Check if signed url is valid
              if (secure_compare($url_check, $check)) {

                # TODO: Remove authorization stuff!

                # Rewrite parameter
                $v->output->{$name} = $url->to_string;
                return;
              };
            };
          };
        };
      };

      $err //= 'Redirect is invalid';

      # Emit hook
      $plugins->emit_hook(
        on_open_redirect_attack => ( $name, $return_url, $err )
      );

      # Warn in log
      # Prevents log-injection attack
      $log->warn(
        "Open Redirect Attack - $err: URL for " .
          quote($name) . ' is ' . quote($return_url)
        );

      return $err;
    }
  );
};


# secrets attribute
sub secrets {
  my $self = shift;
  if (@_ > 0) {
    $self->{secrets} = shift;
  };
  return $self->{secrets} // [];
};


# Check for local Path
# Based on http://www.asp.net/mvc/overview/security/preventing-open-redirection-attacks
sub _local_path {
  my $url = url_unescape $_[0];
  return 1 if $url =~ m!^(?:/(?:[^\/\\]|$)|~\/.)!;
  return;
};


1;


__END__