{"action":"created","issue":{"url":"https://api.github.com/repos/go-gitea/gitea/issues/4332","repository_url":"https://api.github.com/repos/go-gitea/gitea","labels_url":"https://api.github.com/repos/go-gitea/gitea/issues/4332/labels{/name}","comments_url":"https://api.github.com/repos/go-gitea/gitea/issues/4332/comments","events_url":"https://api.github.com/repos/go-gitea/gitea/issues/4332/events","html_url":"https://github.com/go-gitea/gitea/issues/4332","id":336635224,"node_id":"MDU6SXNzdWUzMzY2MzUyMjQ=","number":4332,"title":"Open Redirect vulnerability on internal links","user":{"login":"cezar97","id":34601855,"node_id":"MDQ6VXNlcjM0NjAxODU1","avatar_url":"https://avatars3.githubusercontent.com/u/34601855?v=4","gravatar_id":"","url":"https://api.github.com/users/cezar97","html_url":"https://github.com/cezar97","followers_url":"https://api.github.com/users/cezar97/followers","following_url":"https://api.github.com/users/cezar97/following{/other_user}","gists_url":"https://api.github.com/users/cezar97/gists{/gist_id}","starred_url":"https://api.github.com/users/cezar97/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cezar97/subscriptions","organizations_url":"https://api.github.com/users/cezar97/orgs","repos_url":"https://api.github.com/users/cezar97/repos","events_url":"https://api.github.com/users/cezar97/events{/privacy}","received_events_url":"https://api.github.com/users/cezar97/received_events","type":"User","site_admin":false},"labels":[{"id":472744938,"node_id":"MDU6TGFiZWw0NzI3NDQ5Mzg=","url":"https://api.github.com/repos/go-gitea/gitea/labels/kind/bug","name":"kind/bug","color":"ee0701","default":false},{"id":474798916,"node_id":"MDU6TGFiZWw0NzQ3OTg5MTY=","url":"https://api.github.com/repos/go-gitea/gitea/labels/kind/security","name":"kind/security","color":"0052cc","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-06-28T14:02:25Z","updated_at":"2018-06-28T15:14:50Z","closed_at":null,"author_association":"NONE","body":"<!--\r\n    1. Please speak English, this is the language all of us can speak and write.\r\n    2. Please ask questions or configuration/deploy problems on our Discord \r\n       server (https://discord.gg/NsatcWJ) or forum (https://discourse.gitea.io).\r\n    3. Please take a moment to check that your issue doesn't already exist.\r\n    4. Please give all relevant information below for bug reports, because \r\n       incomplete details will be handled as an invalid report.\r\n-->\r\n\r\n- Gitea version (or commit ref): any\r\n- Git version: not relevant\r\n- Operating system: not relevant\r\n- Database (use `[x]`):\r\n  - [ ] PostgreSQL\r\n  - [ ] MySQL\r\n  - [ ] MSSQL\r\n  - [ ] SQLite\r\n- Can you reproduce the bug at https://try.gitea.io:\r\n  - [x] Yes (provide example URL)\r\n  - [ ] No\r\n  - [ ] Not relevant\r\n- Log gist: not relevent\r\n\r\n## Description\r\n\r\nAs already said in #4307, PR #4312 doesn't mitigate the issue because there are still Open Redirect issues in other parts of Gitea, thus is possible to redirect the login to an internal link where the issue is not mitigated. See the following url:\r\nhttps://try.gitea.io/user/login?redirect_to=https://try.gitea.io/lafriks/action/follow?redirect_to=//github.com\r\nor shorter:\r\nhttps://try.gitea.io/user/login?redirect_to=/lafriks/action/follow?redirect_to=//github.com.\r\nLinks affected:\r\n* Follow / Unfollow user\r\n* Watch / Unwatch a repository\r\n* Star / Unstar a repository\r\n\r\n## Screenshots\r\n\r\nNone\r\n<!-- **If this issue involves the Web Interface, please include a screenshot** -->\r\nEDIT: Added links affected."},"comment":{"url":"https://api.github.com/repos/go-gitea/gitea/issues/comments/401070263","html_url":"https://github.com/go-gitea/gitea/issues/4332#issuecomment-401070263","issue_url":"https://api.github.com/repos/go-gitea/gitea/issues/4332","id":401070263,"node_id":"MDEyOklzc3VlQ29tbWVudDQwMTA3MDI2Mw==","user":{"login":"cezar97","id":34601855,"node_id":"MDQ6VXNlcjM0NjAxODU1","avatar_url":"https://avatars3.githubusercontent.com/u/34601855?v=4","gravatar_id":"","url":"https://api.github.com/users/cezar97","html_url":"https://github.com/cezar97","followers_url":"https://api.github.com/users/cezar97/followers","following_url":"https://api.github.com/users/cezar97/following{/other_user}","gists_url":"https://api.github.com/users/cezar97/gists{/gist_id}","starred_url":"https://api.github.com/users/cezar97/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cezar97/subscriptions","organizations_url":"https://api.github.com/users/cezar97/orgs","repos_url":"https://api.github.com/users/cezar97/repos","events_url":"https://api.github.com/users/cezar97/events{/privacy}","received_events_url":"https://api.github.com/users/cezar97/received_events","type":"User","site_admin":false},"created_at":"2018-06-28T15:14:50Z","updated_at":"2018-06-28T15:14:50Z","author_association":"NONE","body":"Oh, this one is far more serious than I thought. In fact it can be exploited with issue #4335.\r\nPayload example: https://try.gitea.io/user/login?redirect_to=/cezar97/Gitea_Issue_Wiki/wiki."}}
{"actor":{"display_login":"cezar97"}}