From: Ben Darnell <ben@bendarnell.com>
Date: Sun, 14 May 2023 00:58:52 +0000 (-0400)
Subject: web: Fix an open redirect in StaticFileHandler
X-Git-Tag: v6.4.0b1~35^2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=refs%2Fpull%2F3266%2Fhead;p=thirdparty%2Ftornado.git

web: Fix an open redirect in StaticFileHandler

Under some configurations the default_filename redirect could be exploited
to redirect to an attacker-controlled site. This change refuses to redirect
to URLs that could be misinterpreted.

A test case for the specific vulnerable configuration will follow after the
patch has been available.
---

diff --git a/tornado/web.py b/tornado/web.py
index 3b676e3c2..565140493 100644
--- a/tornado/web.py
+++ b/tornado/web.py
@@ -2879,6 +2879,15 @@ class StaticFileHandler(RequestHandler):
             # but there is some prefix to the path that was already
             # trimmed by the routing
             if not self.request.path.endswith("/"):
+                if self.request.path.startswith("//"):
+                    # A redirect with two initial slashes is a "protocol-relative" URL.
+                    # This means the next path segment is treated as a hostname instead
+                    # of a part of the path, making this effectively an open redirect.
+                    # Reject paths starting with two slashes to prevent this.
+                    # This is only reachable under certain configurations.
+                    raise HTTPError(
+                        403, "cannot redirect path with two initial slashes"
+                    )
                 self.redirect(self.request.path + "/", permanent=True)
                 return None
             absolute_path = os.path.join(absolute_path, self.default_filename)