diff --git a/BFF/v2/TokenExchange/TokenExchange.IdentityServer/wwwroot/js/signin-redirect.js b/BFF/v2/TokenExchange/TokenExchange.IdentityServer/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/BFF/v2/TokenExchange/TokenExchange.IdentityServer/wwwroot/js/signin-redirect.js +++ b/BFF/v2/TokenExchange/TokenExchange.IdentityServer/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/BFF/v3/TokenExchange/TokenExchange.IdentityServer/wwwroot/js/signin-redirect.js b/BFF/v3/TokenExchange/TokenExchange.IdentityServer/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/BFF/v3/TokenExchange/TokenExchange.IdentityServer/wwwroot/js/signin-redirect.js +++ b/BFF/v3/TokenExchange/TokenExchange.IdentityServer/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/BFF/v3/docker/ContainerizedIdentityServer/wwwroot/js/signin-redirect.js b/BFF/v3/docker/ContainerizedIdentityServer/wwwroot/js/signin-redirect.js index 598de4ca1..172885be3 100644 --- a/BFF/v3/docker/ContainerizedIdentityServer/wwwroot/js/signin-redirect.js +++ b/BFF/v3/docker/ContainerizedIdentityServer/wwwroot/js/signin-redirect.js @@ -1,8 +1,5 @@ "use strict"; -/** - * Performs automatic redirect back to the native client application after signin. - */ (function () { var meta = document.querySelector("meta[http-equiv=refresh]"); if (!meta) { @@ -10,21 +7,25 @@ return; } - var url = meta.getAttribute("data-url"); - if (!url) { + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { console.error("No signin redirect URL found in meta tag."); return; } - // *** Protocol Validation (https://codeql.github.com/codeql-query-help/javascript/js-xss-through-dom/) *** - // Ensure the URL starts with http: or https: to prevent potential XSS via javascript: URIs - // Convert to lowercase for case-insensitive comparison. - var lowerUrl = url.toLowerCase(); - if (!lowerUrl.startsWith("http:") && !lowerUrl.startsWith("https:")) { - console.error("Signin redirect URL has an invalid scheme:", url); + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); return; } - // If the URL is valid (for web), perform the redirect - window.location.href = url; + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; })(); diff --git a/BFF/v4/MultiFrontendSSO/MultiFrontendSSO.Client/wwwroot/js/signin-redirect.js b/BFF/v4/MultiFrontendSSO/MultiFrontendSSO.Client/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/BFF/v4/MultiFrontendSSO/MultiFrontendSSO.Client/wwwroot/js/signin-redirect.js +++ b/BFF/v4/MultiFrontendSSO/MultiFrontendSSO.Client/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/BFF/v4/MultiFrontendSSO/MultiFrontendSSO.IdentityServer/idsrv-wwwroot/js/signin-redirect.js b/BFF/v4/MultiFrontendSSO/MultiFrontendSSO.IdentityServer/idsrv-wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/BFF/v4/MultiFrontendSSO/MultiFrontendSSO.IdentityServer/idsrv-wwwroot/js/signin-redirect.js +++ b/BFF/v4/MultiFrontendSSO/MultiFrontendSSO.IdentityServer/idsrv-wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/BFF/v4/TokenExchange/TokenExchange.IdentityServer/wwwroot/js/signin-redirect.js b/BFF/v4/TokenExchange/TokenExchange.IdentityServer/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/BFF/v4/TokenExchange/TokenExchange.IdentityServer/wwwroot/js/signin-redirect.js +++ b/BFF/v4/TokenExchange/TokenExchange.IdentityServer/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/BFF/v4/docker/ContainerizedIdentityServer/wwwroot/js/signin-redirect.js b/BFF/v4/docker/ContainerizedIdentityServer/wwwroot/js/signin-redirect.js index 598de4ca1..172885be3 100644 --- a/BFF/v4/docker/ContainerizedIdentityServer/wwwroot/js/signin-redirect.js +++ b/BFF/v4/docker/ContainerizedIdentityServer/wwwroot/js/signin-redirect.js @@ -1,8 +1,5 @@ "use strict"; -/** - * Performs automatic redirect back to the native client application after signin. - */ (function () { var meta = document.querySelector("meta[http-equiv=refresh]"); if (!meta) { @@ -10,21 +7,25 @@ return; } - var url = meta.getAttribute("data-url"); - if (!url) { + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { console.error("No signin redirect URL found in meta tag."); return; } - // *** Protocol Validation (https://codeql.github.com/codeql-query-help/javascript/js-xss-through-dom/) *** - // Ensure the URL starts with http: or https: to prevent potential XSS via javascript: URIs - // Convert to lowercase for case-insensitive comparison. - var lowerUrl = url.toLowerCase(); - if (!lowerUrl.startsWith("http:") && !lowerUrl.startsWith("https:")) { - console.error("Signin redirect URL has an invalid scheme:", url); + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); return; } - // If the URL is valid (for web), perform the redirect - window.location.href = url; + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; })(); diff --git a/IdentityServer/v7/AspNetIdentityPasskeys/IdentityServerAspNetIdentityPasskeys/wwwroot/js/signin-redirect.js b/IdentityServer/v7/AspNetIdentityPasskeys/IdentityServerAspNetIdentityPasskeys/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v7/AspNetIdentityPasskeys/IdentityServerAspNetIdentityPasskeys/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v7/AspNetIdentityPasskeys/IdentityServerAspNetIdentityPasskeys/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v7/Configuration/IdentityServerHost/wwwroot/js/signin-redirect.js b/IdentityServer/v7/Configuration/IdentityServerHost/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v7/Configuration/IdentityServerHost/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v7/Configuration/IdentityServerHost/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v7/Diagnostics/Aspire/IdentityServer/wwwroot/js/signin-redirect.js b/IdentityServer/v7/Diagnostics/Aspire/IdentityServer/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v7/Diagnostics/Aspire/IdentityServer/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v7/Diagnostics/Aspire/IdentityServer/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v7/Diagnostics/Otel/src/wwwroot/js/signin-redirect.js b/IdentityServer/v7/Diagnostics/Otel/src/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v7/Diagnostics/Otel/src/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v7/Diagnostics/Otel/src/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v7/IdentityServerHost/src/wwwroot/js/signin-redirect.js b/IdentityServer/v7/IdentityServerHost/src/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v7/IdentityServerHost/src/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v7/IdentityServerHost/src/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v7/MTLS/IdentityServerHost/wwwroot/js/signin-redirect.js b/IdentityServer/v7/MTLS/IdentityServerHost/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v7/MTLS/IdentityServerHost/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v7/MTLS/IdentityServerHost/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v7/McpDemo/McpDemo.IdentityServer/wwwroot/js/signin-redirect.js b/IdentityServer/v7/McpDemo/McpDemo.IdentityServer/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v7/McpDemo/McpDemo.IdentityServer/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v7/McpDemo/McpDemo.IdentityServer/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v7/PAT/IdentityServerHost/wwwroot/js/signin-redirect.js b/IdentityServer/v7/PAT/IdentityServerHost/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v7/PAT/IdentityServerHost/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v7/PAT/IdentityServerHost/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v7/Quickstarts/2_InteractiveAspNetCore/src/IdentityServer/wwwroot/js/signin-redirect.js b/IdentityServer/v7/Quickstarts/2_InteractiveAspNetCore/src/IdentityServer/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v7/Quickstarts/2_InteractiveAspNetCore/src/IdentityServer/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v7/Quickstarts/2_InteractiveAspNetCore/src/IdentityServer/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v7/Quickstarts/3_AspNetCoreAndApis/src/IdentityServer/wwwroot/js/signin-redirect.js b/IdentityServer/v7/Quickstarts/3_AspNetCoreAndApis/src/IdentityServer/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100755 --- a/IdentityServer/v7/Quickstarts/3_AspNetCoreAndApis/src/IdentityServer/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v7/Quickstarts/3_AspNetCoreAndApis/src/IdentityServer/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v7/Quickstarts/3a_TokenManagement/src/IdentityServer/wwwroot/js/signin-redirect.js b/IdentityServer/v7/Quickstarts/3a_TokenManagement/src/IdentityServer/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v7/Quickstarts/3a_TokenManagement/src/IdentityServer/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v7/Quickstarts/3a_TokenManagement/src/IdentityServer/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v7/Quickstarts/4_EntityFramework/src/IdentityServer/wwwroot/js/signin-redirect.js b/IdentityServer/v7/Quickstarts/4_EntityFramework/src/IdentityServer/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100755 --- a/IdentityServer/v7/Quickstarts/4_EntityFramework/src/IdentityServer/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v7/Quickstarts/4_EntityFramework/src/IdentityServer/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v7/Quickstarts/5_AspNetIdentity/src/IdentityServerAspNetIdentity/wwwroot/js/signin-redirect.js b/IdentityServer/v7/Quickstarts/5_AspNetIdentity/src/IdentityServerAspNetIdentity/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v7/Quickstarts/5_AspNetIdentity/src/IdentityServerAspNetIdentity/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v7/Quickstarts/5_AspNetIdentity/src/IdentityServerAspNetIdentity/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v7/Quickstarts/6_JS_with_backend/src/IdentityServer/wwwroot/js/signin-redirect.js b/IdentityServer/v7/Quickstarts/6_JS_with_backend/src/IdentityServer/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100755 --- a/IdentityServer/v7/Quickstarts/6_JS_with_backend/src/IdentityServer/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v7/Quickstarts/6_JS_with_backend/src/IdentityServer/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v7/Quickstarts/6_JS_without_backend/src/IdentityServer/wwwroot/js/signin-redirect.js b/IdentityServer/v7/Quickstarts/6_JS_without_backend/src/IdentityServer/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100755 --- a/IdentityServer/v7/Quickstarts/6_JS_without_backend/src/IdentityServer/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v7/Quickstarts/6_JS_without_backend/src/IdentityServer/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v7/SessionManagement/IdentityServerHost/wwwroot/js/signin-redirect.js b/IdentityServer/v7/SessionManagement/IdentityServerHost/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v7/SessionManagement/IdentityServerHost/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v7/SessionManagement/IdentityServerHost/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v7/SessionMigration/wwwroot/js/signin-redirect.js b/IdentityServer/v7/SessionMigration/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v7/SessionMigration/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v7/SessionMigration/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v7/UserInteraction/Ciba/IdentityServerHost/wwwroot/js/signin-redirect.js b/IdentityServer/v7/UserInteraction/Ciba/IdentityServerHost/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v7/UserInteraction/Ciba/IdentityServerHost/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v7/UserInteraction/Ciba/IdentityServerHost/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v7/UserInteraction/DynamicProviders/IdentityServerHost/wwwroot/js/signin-redirect.js b/IdentityServer/v7/UserInteraction/DynamicProviders/IdentityServerHost/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v7/UserInteraction/DynamicProviders/IdentityServerHost/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v7/UserInteraction/DynamicProviders/IdentityServerHost/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v7/UserInteraction/ProfileService/IdentityServerHost/wwwroot/js/signin-redirect.js b/IdentityServer/v7/UserInteraction/ProfileService/IdentityServerHost/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v7/UserInteraction/ProfileService/IdentityServerHost/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v7/UserInteraction/ProfileService/IdentityServerHost/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v7/UserInteraction/SpaLoginUi/IdentityServerHost/wwwroot/js/signin-redirect.js b/IdentityServer/v7/UserInteraction/SpaLoginUi/IdentityServerHost/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v7/UserInteraction/SpaLoginUi/IdentityServerHost/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v7/UserInteraction/SpaLoginUi/IdentityServerHost/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v7/UserInteraction/StepUp/IdentityServerHost/wwwroot/js/signin-redirect.js b/IdentityServer/v7/UserInteraction/StepUp/IdentityServerHost/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v7/UserInteraction/StepUp/IdentityServerHost/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v7/UserInteraction/StepUp/IdentityServerHost/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v7/UserInteraction/WindowsAuthentication/IdentityServerHost/wwwroot/js/signin-redirect.js b/IdentityServer/v7/UserInteraction/WindowsAuthentication/IdentityServerHost/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v7/UserInteraction/WindowsAuthentication/IdentityServerHost/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v7/UserInteraction/WindowsAuthentication/IdentityServerHost/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v7/UserInteraction/WsFederationDynamicProviders/IdentityServerHost/wwwroot/js/signin-redirect.js b/IdentityServer/v7/UserInteraction/WsFederationDynamicProviders/IdentityServerHost/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100755 --- a/IdentityServer/v7/UserInteraction/WsFederationDynamicProviders/IdentityServerHost/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v7/UserInteraction/WsFederationDynamicProviders/IdentityServerHost/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v8/AspNetIdentityPasskeys/IdentityServerAspNetIdentityPasskeys/wwwroot/js/signin-redirect.js b/IdentityServer/v8/AspNetIdentityPasskeys/IdentityServerAspNetIdentityPasskeys/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v8/AspNetIdentityPasskeys/IdentityServerAspNetIdentityPasskeys/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v8/AspNetIdentityPasskeys/IdentityServerAspNetIdentityPasskeys/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v8/Configuration/IdentityServerHost/wwwroot/js/signin-redirect.js b/IdentityServer/v8/Configuration/IdentityServerHost/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v8/Configuration/IdentityServerHost/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v8/Configuration/IdentityServerHost/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v8/Diagnostics/Aspire/IdentityServer/wwwroot/js/signin-redirect.js b/IdentityServer/v8/Diagnostics/Aspire/IdentityServer/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v8/Diagnostics/Aspire/IdentityServer/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v8/Diagnostics/Aspire/IdentityServer/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v8/Diagnostics/Otel/src/wwwroot/js/signin-redirect.js b/IdentityServer/v8/Diagnostics/Otel/src/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v8/Diagnostics/Otel/src/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v8/Diagnostics/Otel/src/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v8/IdentityServerHost/src/wwwroot/js/signin-redirect.js b/IdentityServer/v8/IdentityServerHost/src/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v8/IdentityServerHost/src/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v8/IdentityServerHost/src/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v8/MTLS/IdentityServerHost/wwwroot/js/signin-redirect.js b/IdentityServer/v8/MTLS/IdentityServerHost/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v8/MTLS/IdentityServerHost/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v8/MTLS/IdentityServerHost/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v8/McpDemo/McpDemo.IdentityServer/wwwroot/js/signin-redirect.js b/IdentityServer/v8/McpDemo/McpDemo.IdentityServer/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v8/McpDemo/McpDemo.IdentityServer/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v8/McpDemo/McpDemo.IdentityServer/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v8/PAT/IdentityServerHost/wwwroot/js/signin-redirect.js b/IdentityServer/v8/PAT/IdentityServerHost/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v8/PAT/IdentityServerHost/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v8/PAT/IdentityServerHost/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v8/Quickstarts/2_InteractiveAspNetCore/src/IdentityServer/wwwroot/js/signin-redirect.js b/IdentityServer/v8/Quickstarts/2_InteractiveAspNetCore/src/IdentityServer/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v8/Quickstarts/2_InteractiveAspNetCore/src/IdentityServer/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v8/Quickstarts/2_InteractiveAspNetCore/src/IdentityServer/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v8/Quickstarts/3_AspNetCoreAndApis/src/IdentityServer/wwwroot/js/signin-redirect.js b/IdentityServer/v8/Quickstarts/3_AspNetCoreAndApis/src/IdentityServer/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100755 --- a/IdentityServer/v8/Quickstarts/3_AspNetCoreAndApis/src/IdentityServer/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v8/Quickstarts/3_AspNetCoreAndApis/src/IdentityServer/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v8/Quickstarts/3a_TokenManagement/src/IdentityServer/wwwroot/js/signin-redirect.js b/IdentityServer/v8/Quickstarts/3a_TokenManagement/src/IdentityServer/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v8/Quickstarts/3a_TokenManagement/src/IdentityServer/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v8/Quickstarts/3a_TokenManagement/src/IdentityServer/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v8/Quickstarts/4_EntityFramework/src/IdentityServer/wwwroot/js/signin-redirect.js b/IdentityServer/v8/Quickstarts/4_EntityFramework/src/IdentityServer/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100755 --- a/IdentityServer/v8/Quickstarts/4_EntityFramework/src/IdentityServer/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v8/Quickstarts/4_EntityFramework/src/IdentityServer/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v8/Quickstarts/5_AspNetIdentity/src/IdentityServerAspNetIdentity/wwwroot/js/signin-redirect.js b/IdentityServer/v8/Quickstarts/5_AspNetIdentity/src/IdentityServerAspNetIdentity/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v8/Quickstarts/5_AspNetIdentity/src/IdentityServerAspNetIdentity/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v8/Quickstarts/5_AspNetIdentity/src/IdentityServerAspNetIdentity/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v8/Quickstarts/6_JS_with_backend/src/IdentityServer/wwwroot/js/signin-redirect.js b/IdentityServer/v8/Quickstarts/6_JS_with_backend/src/IdentityServer/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100755 --- a/IdentityServer/v8/Quickstarts/6_JS_with_backend/src/IdentityServer/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v8/Quickstarts/6_JS_with_backend/src/IdentityServer/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v8/Quickstarts/6_JS_without_backend/src/IdentityServer/wwwroot/js/signin-redirect.js b/IdentityServer/v8/Quickstarts/6_JS_without_backend/src/IdentityServer/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100755 --- a/IdentityServer/v8/Quickstarts/6_JS_without_backend/src/IdentityServer/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v8/Quickstarts/6_JS_without_backend/src/IdentityServer/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v8/SAML/Basic/IdentityServerHost/wwwroot/js/signin-redirect.js b/IdentityServer/v8/SAML/Basic/IdentityServerHost/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v8/SAML/Basic/IdentityServerHost/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v8/SAML/Basic/IdentityServerHost/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v8/SAML/IdPInitiated/IdentityServerHost/wwwroot/js/signin-redirect.js b/IdentityServer/v8/SAML/IdPInitiated/IdentityServerHost/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v8/SAML/IdPInitiated/IdentityServerHost/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v8/SAML/IdPInitiated/IdentityServerHost/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v8/SessionManagement/IdentityServerHost/wwwroot/js/signin-redirect.js b/IdentityServer/v8/SessionManagement/IdentityServerHost/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v8/SessionManagement/IdentityServerHost/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v8/SessionManagement/IdentityServerHost/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v8/SessionMigration/wwwroot/js/signin-redirect.js b/IdentityServer/v8/SessionMigration/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v8/SessionMigration/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v8/SessionMigration/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v8/UserInteraction/Ciba/IdentityServerHost/wwwroot/js/signin-redirect.js b/IdentityServer/v8/UserInteraction/Ciba/IdentityServerHost/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v8/UserInteraction/Ciba/IdentityServerHost/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v8/UserInteraction/Ciba/IdentityServerHost/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v8/UserInteraction/DynamicProviders/IdentityServerHost/wwwroot/js/signin-redirect.js b/IdentityServer/v8/UserInteraction/DynamicProviders/IdentityServerHost/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v8/UserInteraction/DynamicProviders/IdentityServerHost/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v8/UserInteraction/DynamicProviders/IdentityServerHost/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v8/UserInteraction/ProfileService/IdentityServerHost/wwwroot/js/signin-redirect.js b/IdentityServer/v8/UserInteraction/ProfileService/IdentityServerHost/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v8/UserInteraction/ProfileService/IdentityServerHost/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v8/UserInteraction/ProfileService/IdentityServerHost/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v8/UserInteraction/SpaLoginUi/IdentityServerHost/wwwroot/js/signin-redirect.js b/IdentityServer/v8/UserInteraction/SpaLoginUi/IdentityServerHost/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v8/UserInteraction/SpaLoginUi/IdentityServerHost/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v8/UserInteraction/SpaLoginUi/IdentityServerHost/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v8/UserInteraction/StepUp/IdentityServerHost/wwwroot/js/signin-redirect.js b/IdentityServer/v8/UserInteraction/StepUp/IdentityServerHost/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v8/UserInteraction/StepUp/IdentityServerHost/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v8/UserInteraction/StepUp/IdentityServerHost/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v8/UserInteraction/WindowsAuthentication/IdentityServerHost/wwwroot/js/signin-redirect.js b/IdentityServer/v8/UserInteraction/WindowsAuthentication/IdentityServerHost/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v8/UserInteraction/WindowsAuthentication/IdentityServerHost/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v8/UserInteraction/WindowsAuthentication/IdentityServerHost/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v8/UserInteraction/WsFederationDynamicProviders/IdentityServerHost/wwwroot/js/signin-redirect.js b/IdentityServer/v8/UserInteraction/WsFederationDynamicProviders/IdentityServerHost/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100755 --- a/IdentityServer/v8/UserInteraction/WsFederationDynamicProviders/IdentityServerHost/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v8/UserInteraction/WsFederationDynamicProviders/IdentityServerHost/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/various/clients/Owin/IdentityServerHost/wwwroot/js/signin-redirect.js b/various/clients/Owin/IdentityServerHost/wwwroot/js/signin-redirect.js index bdfe877dd..172885be3 100644 --- a/various/clients/Owin/IdentityServerHost/wwwroot/js/signin-redirect.js +++ b/various/clients/Owin/IdentityServerHost/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})();