Refactor OpenAPI handling and update samples#296
Conversation
Improve readability of `ProxyingOpenApiDocument` logic. Update OpenAPI document writing method to handle JSON serialization asynchronously and add inline comments for future compatibility issues with OpenAPI library and .NET 10.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| @@ -0,0 +1 @@ | |||
| window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); | |||
Check failure
Code scanning / CodeQL
DOM text reinterpreted as HTML High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 4 days ago
In general, to fix this type of problem you should not directly trust text/attributes taken from the DOM when using them in sensitive operations (HTML insertion, script execution, navigation). Instead, sanitize and validate the value, and constrain it to a safe set of destinations (e.g., same-origin paths or a whitelist of allowed hosts). If the value is meant to be a simple path, restrict it to that; if it's a full URL, parse it and enforce origin checks before using it.
For this specific file, the best fix with minimal functional change is:
- Read the
data-urlattribute into a variable. - Parse it using the standard
URLconstructor to ensure it is syntactically valid and to inspect its origin. - Enforce that the destination is same-origin (or otherwise constrained) before assigning to
window.location.href. If it fails validation, do not redirect (or optionally fall back to a safe default like/).
This keeps the existing behavior for legitimate same-origin URLs while preventing navigation to arbitrary attacker-controlled destinations. No external libraries are needed; the built-in URL API is sufficient. All changes are confined to BFF/v4/TokenExchange/TokenExchange.IdentityServer/wwwroot/js/signin-redirect.js line 1, expanding it into a small, explicit redirect routine.
| @@ -1 +1,24 @@ | ||
| window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); | ||
| (function () { | ||
| var metaRefresh = document.querySelector("meta[http-equiv=refresh]"); | ||
| if (!metaRefresh) { | ||
| return; | ||
| } | ||
|
|
||
| var targetUrl = metaRefresh.getAttribute("data-url"); | ||
| if (!targetUrl) { | ||
| return; | ||
| } | ||
|
|
||
| try { | ||
| // Use URL API to normalize and inspect the target | ||
| var parsedTarget = new URL(targetUrl, window.location.origin); | ||
|
|
||
| // Only allow redirects to the same origin to avoid open redirects / XSS chains | ||
| if (parsedTarget.origin === window.location.origin) { | ||
| window.location.href = parsedTarget.href; | ||
| } | ||
| } catch (e) { | ||
| // If the URL is invalid, do not redirect | ||
| return; | ||
| } | ||
| })(); |
4 participants
Summary
ProxyingOpenApiDocumentfor better readability and maintainability.tokenexchangesample to ensure functionality.