Repository navigation
Fix an open redirect via $n captures and an import that could jump ahead of live rules - #50
Merged
Merged
Conversation
wentz-s
force-pushed
the
fix/open-redirect-and-import
branch
from
October 15, 2026 16:10
ef955d0 to
8f2b1a7
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Edge — open redirect (47c9ff1). Filling
$1from the viewer's URL could move a redirect off the site:/$1+//evil.com→Location: //evil.com,https://www.example.com$1+@evil.com/→ evil.com. The edge now checks the target after substitution: path templates stay on the site (//evil.com→/evil.com), absolute templates keep their host, capture-led ones may only reach the viewer's host. Targets with whitespace/control characters (which browsers strip) or empty targets are not redirected. Refusals are logged once per rule, without the viewer's URL.Console — import (ef955d0). When a host's existing rules couldn't be read, the import started from priority 0 and could place new rules in front of live ones. That host is now skipped, each of its rows says why, and other hosts still import.
Behaviour change: a rule that relies on a capture to redirect to another domain (including
https://$1.example.com/) stops redirecting — write the domain in the template.