From 052ad74043c6640bf637d8de342ea53ffb7726e9 Mon Sep 17 00:00:00 2001 From: Damian Hickey Date: Tue, 27 Oct 2026 09:13:22 +0100 Subject: [PATCH] Harden signin redirects while preserving native client schemes Parse redirect URLs before denying javascript, data, and vbscript schemes. Handle absent and malformed redirect metadata and use the normalized URL for navigation in all 58 sample copies. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .../wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../wwwroot/js/signin-redirect.js | 27 ++++++++-------- .../wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../idsrv-wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../wwwroot/js/signin-redirect.js | 27 ++++++++-------- .../wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../Otel/src/wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../src/wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../Otel/src/wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../src/wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- .../wwwroot/js/signin-redirect.js | 32 ++++++++++++++++++- 58 files changed, 1764 insertions(+), 82 deletions(-) diff --git a/BFF/v2/TokenExchange/TokenExchange.IdentityServer/wwwroot/js/signin-redirect.js b/BFF/v2/TokenExchange/TokenExchange.IdentityServer/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/BFF/v2/TokenExchange/TokenExchange.IdentityServer/wwwroot/js/signin-redirect.js +++ b/BFF/v2/TokenExchange/TokenExchange.IdentityServer/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/BFF/v3/TokenExchange/TokenExchange.IdentityServer/wwwroot/js/signin-redirect.js b/BFF/v3/TokenExchange/TokenExchange.IdentityServer/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/BFF/v3/TokenExchange/TokenExchange.IdentityServer/wwwroot/js/signin-redirect.js +++ b/BFF/v3/TokenExchange/TokenExchange.IdentityServer/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/BFF/v3/docker/ContainerizedIdentityServer/wwwroot/js/signin-redirect.js b/BFF/v3/docker/ContainerizedIdentityServer/wwwroot/js/signin-redirect.js index 598de4ca1..172885be3 100644 --- a/BFF/v3/docker/ContainerizedIdentityServer/wwwroot/js/signin-redirect.js +++ b/BFF/v3/docker/ContainerizedIdentityServer/wwwroot/js/signin-redirect.js @@ -1,8 +1,5 @@ "use strict"; -/** - * Performs automatic redirect back to the native client application after signin. - */ (function () { var meta = document.querySelector("meta[http-equiv=refresh]"); if (!meta) { @@ -10,21 +7,25 @@ return; } - var url = meta.getAttribute("data-url"); - if (!url) { + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { console.error("No signin redirect URL found in meta tag."); return; } - // *** Protocol Validation (https://codeql.github.com/codeql-query-help/javascript/js-xss-through-dom/) *** - // Ensure the URL starts with http: or https: to prevent potential XSS via javascript: URIs - // Convert to lowercase for case-insensitive comparison. - var lowerUrl = url.toLowerCase(); - if (!lowerUrl.startsWith("http:") && !lowerUrl.startsWith("https:")) { - console.error("Signin redirect URL has an invalid scheme:", url); + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); return; } - // If the URL is valid (for web), perform the redirect - window.location.href = url; + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; })(); diff --git a/BFF/v4/MultiFrontendSSO/MultiFrontendSSO.Client/wwwroot/js/signin-redirect.js b/BFF/v4/MultiFrontendSSO/MultiFrontendSSO.Client/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/BFF/v4/MultiFrontendSSO/MultiFrontendSSO.Client/wwwroot/js/signin-redirect.js +++ b/BFF/v4/MultiFrontendSSO/MultiFrontendSSO.Client/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/BFF/v4/MultiFrontendSSO/MultiFrontendSSO.IdentityServer/idsrv-wwwroot/js/signin-redirect.js b/BFF/v4/MultiFrontendSSO/MultiFrontendSSO.IdentityServer/idsrv-wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/BFF/v4/MultiFrontendSSO/MultiFrontendSSO.IdentityServer/idsrv-wwwroot/js/signin-redirect.js +++ b/BFF/v4/MultiFrontendSSO/MultiFrontendSSO.IdentityServer/idsrv-wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/BFF/v4/TokenExchange/TokenExchange.IdentityServer/wwwroot/js/signin-redirect.js b/BFF/v4/TokenExchange/TokenExchange.IdentityServer/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/BFF/v4/TokenExchange/TokenExchange.IdentityServer/wwwroot/js/signin-redirect.js +++ b/BFF/v4/TokenExchange/TokenExchange.IdentityServer/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/BFF/v4/docker/ContainerizedIdentityServer/wwwroot/js/signin-redirect.js b/BFF/v4/docker/ContainerizedIdentityServer/wwwroot/js/signin-redirect.js index 598de4ca1..172885be3 100644 --- a/BFF/v4/docker/ContainerizedIdentityServer/wwwroot/js/signin-redirect.js +++ b/BFF/v4/docker/ContainerizedIdentityServer/wwwroot/js/signin-redirect.js @@ -1,8 +1,5 @@ "use strict"; -/** - * Performs automatic redirect back to the native client application after signin. - */ (function () { var meta = document.querySelector("meta[http-equiv=refresh]"); if (!meta) { @@ -10,21 +7,25 @@ return; } - var url = meta.getAttribute("data-url"); - if (!url) { + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { console.error("No signin redirect URL found in meta tag."); return; } - // *** Protocol Validation (https://codeql.github.com/codeql-query-help/javascript/js-xss-through-dom/) *** - // Ensure the URL starts with http: or https: to prevent potential XSS via javascript: URIs - // Convert to lowercase for case-insensitive comparison. - var lowerUrl = url.toLowerCase(); - if (!lowerUrl.startsWith("http:") && !lowerUrl.startsWith("https:")) { - console.error("Signin redirect URL has an invalid scheme:", url); + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); return; } - // If the URL is valid (for web), perform the redirect - window.location.href = url; + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; })(); diff --git a/IdentityServer/v7/AspNetIdentityPasskeys/IdentityServerAspNetIdentityPasskeys/wwwroot/js/signin-redirect.js b/IdentityServer/v7/AspNetIdentityPasskeys/IdentityServerAspNetIdentityPasskeys/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v7/AspNetIdentityPasskeys/IdentityServerAspNetIdentityPasskeys/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v7/AspNetIdentityPasskeys/IdentityServerAspNetIdentityPasskeys/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v7/Configuration/IdentityServerHost/wwwroot/js/signin-redirect.js b/IdentityServer/v7/Configuration/IdentityServerHost/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v7/Configuration/IdentityServerHost/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v7/Configuration/IdentityServerHost/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v7/Diagnostics/Aspire/IdentityServer/wwwroot/js/signin-redirect.js b/IdentityServer/v7/Diagnostics/Aspire/IdentityServer/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v7/Diagnostics/Aspire/IdentityServer/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v7/Diagnostics/Aspire/IdentityServer/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v7/Diagnostics/Otel/src/wwwroot/js/signin-redirect.js b/IdentityServer/v7/Diagnostics/Otel/src/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v7/Diagnostics/Otel/src/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v7/Diagnostics/Otel/src/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v7/IdentityServerHost/src/wwwroot/js/signin-redirect.js b/IdentityServer/v7/IdentityServerHost/src/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v7/IdentityServerHost/src/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v7/IdentityServerHost/src/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v7/MTLS/IdentityServerHost/wwwroot/js/signin-redirect.js b/IdentityServer/v7/MTLS/IdentityServerHost/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v7/MTLS/IdentityServerHost/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v7/MTLS/IdentityServerHost/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v7/McpDemo/McpDemo.IdentityServer/wwwroot/js/signin-redirect.js b/IdentityServer/v7/McpDemo/McpDemo.IdentityServer/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v7/McpDemo/McpDemo.IdentityServer/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v7/McpDemo/McpDemo.IdentityServer/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v7/PAT/IdentityServerHost/wwwroot/js/signin-redirect.js b/IdentityServer/v7/PAT/IdentityServerHost/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v7/PAT/IdentityServerHost/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v7/PAT/IdentityServerHost/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v7/Quickstarts/2_InteractiveAspNetCore/src/IdentityServer/wwwroot/js/signin-redirect.js b/IdentityServer/v7/Quickstarts/2_InteractiveAspNetCore/src/IdentityServer/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v7/Quickstarts/2_InteractiveAspNetCore/src/IdentityServer/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v7/Quickstarts/2_InteractiveAspNetCore/src/IdentityServer/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v7/Quickstarts/3_AspNetCoreAndApis/src/IdentityServer/wwwroot/js/signin-redirect.js b/IdentityServer/v7/Quickstarts/3_AspNetCoreAndApis/src/IdentityServer/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100755 --- a/IdentityServer/v7/Quickstarts/3_AspNetCoreAndApis/src/IdentityServer/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v7/Quickstarts/3_AspNetCoreAndApis/src/IdentityServer/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v7/Quickstarts/3a_TokenManagement/src/IdentityServer/wwwroot/js/signin-redirect.js b/IdentityServer/v7/Quickstarts/3a_TokenManagement/src/IdentityServer/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v7/Quickstarts/3a_TokenManagement/src/IdentityServer/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v7/Quickstarts/3a_TokenManagement/src/IdentityServer/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v7/Quickstarts/4_EntityFramework/src/IdentityServer/wwwroot/js/signin-redirect.js b/IdentityServer/v7/Quickstarts/4_EntityFramework/src/IdentityServer/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100755 --- a/IdentityServer/v7/Quickstarts/4_EntityFramework/src/IdentityServer/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v7/Quickstarts/4_EntityFramework/src/IdentityServer/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v7/Quickstarts/5_AspNetIdentity/src/IdentityServerAspNetIdentity/wwwroot/js/signin-redirect.js b/IdentityServer/v7/Quickstarts/5_AspNetIdentity/src/IdentityServerAspNetIdentity/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v7/Quickstarts/5_AspNetIdentity/src/IdentityServerAspNetIdentity/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v7/Quickstarts/5_AspNetIdentity/src/IdentityServerAspNetIdentity/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v7/Quickstarts/6_JS_with_backend/src/IdentityServer/wwwroot/js/signin-redirect.js b/IdentityServer/v7/Quickstarts/6_JS_with_backend/src/IdentityServer/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100755 --- a/IdentityServer/v7/Quickstarts/6_JS_with_backend/src/IdentityServer/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v7/Quickstarts/6_JS_with_backend/src/IdentityServer/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v7/Quickstarts/6_JS_without_backend/src/IdentityServer/wwwroot/js/signin-redirect.js b/IdentityServer/v7/Quickstarts/6_JS_without_backend/src/IdentityServer/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100755 --- a/IdentityServer/v7/Quickstarts/6_JS_without_backend/src/IdentityServer/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v7/Quickstarts/6_JS_without_backend/src/IdentityServer/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v7/SessionManagement/IdentityServerHost/wwwroot/js/signin-redirect.js b/IdentityServer/v7/SessionManagement/IdentityServerHost/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v7/SessionManagement/IdentityServerHost/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v7/SessionManagement/IdentityServerHost/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v7/SessionMigration/wwwroot/js/signin-redirect.js b/IdentityServer/v7/SessionMigration/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v7/SessionMigration/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v7/SessionMigration/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v7/UserInteraction/Ciba/IdentityServerHost/wwwroot/js/signin-redirect.js b/IdentityServer/v7/UserInteraction/Ciba/IdentityServerHost/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v7/UserInteraction/Ciba/IdentityServerHost/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v7/UserInteraction/Ciba/IdentityServerHost/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v7/UserInteraction/DynamicProviders/IdentityServerHost/wwwroot/js/signin-redirect.js b/IdentityServer/v7/UserInteraction/DynamicProviders/IdentityServerHost/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v7/UserInteraction/DynamicProviders/IdentityServerHost/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v7/UserInteraction/DynamicProviders/IdentityServerHost/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v7/UserInteraction/ProfileService/IdentityServerHost/wwwroot/js/signin-redirect.js b/IdentityServer/v7/UserInteraction/ProfileService/IdentityServerHost/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v7/UserInteraction/ProfileService/IdentityServerHost/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v7/UserInteraction/ProfileService/IdentityServerHost/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v7/UserInteraction/SpaLoginUi/IdentityServerHost/wwwroot/js/signin-redirect.js b/IdentityServer/v7/UserInteraction/SpaLoginUi/IdentityServerHost/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v7/UserInteraction/SpaLoginUi/IdentityServerHost/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v7/UserInteraction/SpaLoginUi/IdentityServerHost/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v7/UserInteraction/StepUp/IdentityServerHost/wwwroot/js/signin-redirect.js b/IdentityServer/v7/UserInteraction/StepUp/IdentityServerHost/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v7/UserInteraction/StepUp/IdentityServerHost/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v7/UserInteraction/StepUp/IdentityServerHost/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v7/UserInteraction/WindowsAuthentication/IdentityServerHost/wwwroot/js/signin-redirect.js b/IdentityServer/v7/UserInteraction/WindowsAuthentication/IdentityServerHost/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v7/UserInteraction/WindowsAuthentication/IdentityServerHost/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v7/UserInteraction/WindowsAuthentication/IdentityServerHost/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v7/UserInteraction/WsFederationDynamicProviders/IdentityServerHost/wwwroot/js/signin-redirect.js b/IdentityServer/v7/UserInteraction/WsFederationDynamicProviders/IdentityServerHost/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100755 --- a/IdentityServer/v7/UserInteraction/WsFederationDynamicProviders/IdentityServerHost/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v7/UserInteraction/WsFederationDynamicProviders/IdentityServerHost/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v8/AspNetIdentityPasskeys/IdentityServerAspNetIdentityPasskeys/wwwroot/js/signin-redirect.js b/IdentityServer/v8/AspNetIdentityPasskeys/IdentityServerAspNetIdentityPasskeys/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v8/AspNetIdentityPasskeys/IdentityServerAspNetIdentityPasskeys/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v8/AspNetIdentityPasskeys/IdentityServerAspNetIdentityPasskeys/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v8/Configuration/IdentityServerHost/wwwroot/js/signin-redirect.js b/IdentityServer/v8/Configuration/IdentityServerHost/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v8/Configuration/IdentityServerHost/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v8/Configuration/IdentityServerHost/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v8/Diagnostics/Aspire/IdentityServer/wwwroot/js/signin-redirect.js b/IdentityServer/v8/Diagnostics/Aspire/IdentityServer/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v8/Diagnostics/Aspire/IdentityServer/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v8/Diagnostics/Aspire/IdentityServer/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v8/Diagnostics/Otel/src/wwwroot/js/signin-redirect.js b/IdentityServer/v8/Diagnostics/Otel/src/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v8/Diagnostics/Otel/src/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v8/Diagnostics/Otel/src/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v8/IdentityServerHost/src/wwwroot/js/signin-redirect.js b/IdentityServer/v8/IdentityServerHost/src/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v8/IdentityServerHost/src/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v8/IdentityServerHost/src/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v8/MTLS/IdentityServerHost/wwwroot/js/signin-redirect.js b/IdentityServer/v8/MTLS/IdentityServerHost/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v8/MTLS/IdentityServerHost/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v8/MTLS/IdentityServerHost/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v8/McpDemo/McpDemo.IdentityServer/wwwroot/js/signin-redirect.js b/IdentityServer/v8/McpDemo/McpDemo.IdentityServer/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v8/McpDemo/McpDemo.IdentityServer/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v8/McpDemo/McpDemo.IdentityServer/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v8/PAT/IdentityServerHost/wwwroot/js/signin-redirect.js b/IdentityServer/v8/PAT/IdentityServerHost/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v8/PAT/IdentityServerHost/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v8/PAT/IdentityServerHost/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v8/Quickstarts/2_InteractiveAspNetCore/src/IdentityServer/wwwroot/js/signin-redirect.js b/IdentityServer/v8/Quickstarts/2_InteractiveAspNetCore/src/IdentityServer/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v8/Quickstarts/2_InteractiveAspNetCore/src/IdentityServer/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v8/Quickstarts/2_InteractiveAspNetCore/src/IdentityServer/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v8/Quickstarts/3_AspNetCoreAndApis/src/IdentityServer/wwwroot/js/signin-redirect.js b/IdentityServer/v8/Quickstarts/3_AspNetCoreAndApis/src/IdentityServer/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100755 --- a/IdentityServer/v8/Quickstarts/3_AspNetCoreAndApis/src/IdentityServer/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v8/Quickstarts/3_AspNetCoreAndApis/src/IdentityServer/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v8/Quickstarts/3a_TokenManagement/src/IdentityServer/wwwroot/js/signin-redirect.js b/IdentityServer/v8/Quickstarts/3a_TokenManagement/src/IdentityServer/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v8/Quickstarts/3a_TokenManagement/src/IdentityServer/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v8/Quickstarts/3a_TokenManagement/src/IdentityServer/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v8/Quickstarts/4_EntityFramework/src/IdentityServer/wwwroot/js/signin-redirect.js b/IdentityServer/v8/Quickstarts/4_EntityFramework/src/IdentityServer/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100755 --- a/IdentityServer/v8/Quickstarts/4_EntityFramework/src/IdentityServer/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v8/Quickstarts/4_EntityFramework/src/IdentityServer/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v8/Quickstarts/5_AspNetIdentity/src/IdentityServerAspNetIdentity/wwwroot/js/signin-redirect.js b/IdentityServer/v8/Quickstarts/5_AspNetIdentity/src/IdentityServerAspNetIdentity/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v8/Quickstarts/5_AspNetIdentity/src/IdentityServerAspNetIdentity/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v8/Quickstarts/5_AspNetIdentity/src/IdentityServerAspNetIdentity/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v8/Quickstarts/6_JS_with_backend/src/IdentityServer/wwwroot/js/signin-redirect.js b/IdentityServer/v8/Quickstarts/6_JS_with_backend/src/IdentityServer/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100755 --- a/IdentityServer/v8/Quickstarts/6_JS_with_backend/src/IdentityServer/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v8/Quickstarts/6_JS_with_backend/src/IdentityServer/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v8/Quickstarts/6_JS_without_backend/src/IdentityServer/wwwroot/js/signin-redirect.js b/IdentityServer/v8/Quickstarts/6_JS_without_backend/src/IdentityServer/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100755 --- a/IdentityServer/v8/Quickstarts/6_JS_without_backend/src/IdentityServer/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v8/Quickstarts/6_JS_without_backend/src/IdentityServer/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v8/SAML/Basic/IdentityServerHost/wwwroot/js/signin-redirect.js b/IdentityServer/v8/SAML/Basic/IdentityServerHost/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v8/SAML/Basic/IdentityServerHost/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v8/SAML/Basic/IdentityServerHost/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v8/SAML/IdPInitiated/IdentityServerHost/wwwroot/js/signin-redirect.js b/IdentityServer/v8/SAML/IdPInitiated/IdentityServerHost/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v8/SAML/IdPInitiated/IdentityServerHost/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v8/SAML/IdPInitiated/IdentityServerHost/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v8/SessionManagement/IdentityServerHost/wwwroot/js/signin-redirect.js b/IdentityServer/v8/SessionManagement/IdentityServerHost/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v8/SessionManagement/IdentityServerHost/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v8/SessionManagement/IdentityServerHost/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v8/SessionMigration/wwwroot/js/signin-redirect.js b/IdentityServer/v8/SessionMigration/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v8/SessionMigration/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v8/SessionMigration/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v8/UserInteraction/Ciba/IdentityServerHost/wwwroot/js/signin-redirect.js b/IdentityServer/v8/UserInteraction/Ciba/IdentityServerHost/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v8/UserInteraction/Ciba/IdentityServerHost/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v8/UserInteraction/Ciba/IdentityServerHost/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v8/UserInteraction/DynamicProviders/IdentityServerHost/wwwroot/js/signin-redirect.js b/IdentityServer/v8/UserInteraction/DynamicProviders/IdentityServerHost/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v8/UserInteraction/DynamicProviders/IdentityServerHost/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v8/UserInteraction/DynamicProviders/IdentityServerHost/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v8/UserInteraction/ProfileService/IdentityServerHost/wwwroot/js/signin-redirect.js b/IdentityServer/v8/UserInteraction/ProfileService/IdentityServerHost/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v8/UserInteraction/ProfileService/IdentityServerHost/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v8/UserInteraction/ProfileService/IdentityServerHost/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v8/UserInteraction/SpaLoginUi/IdentityServerHost/wwwroot/js/signin-redirect.js b/IdentityServer/v8/UserInteraction/SpaLoginUi/IdentityServerHost/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v8/UserInteraction/SpaLoginUi/IdentityServerHost/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v8/UserInteraction/SpaLoginUi/IdentityServerHost/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v8/UserInteraction/StepUp/IdentityServerHost/wwwroot/js/signin-redirect.js b/IdentityServer/v8/UserInteraction/StepUp/IdentityServerHost/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v8/UserInteraction/StepUp/IdentityServerHost/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v8/UserInteraction/StepUp/IdentityServerHost/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v8/UserInteraction/WindowsAuthentication/IdentityServerHost/wwwroot/js/signin-redirect.js b/IdentityServer/v8/UserInteraction/WindowsAuthentication/IdentityServerHost/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100644 --- a/IdentityServer/v8/UserInteraction/WindowsAuthentication/IdentityServerHost/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v8/UserInteraction/WindowsAuthentication/IdentityServerHost/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/IdentityServer/v8/UserInteraction/WsFederationDynamicProviders/IdentityServerHost/wwwroot/js/signin-redirect.js b/IdentityServer/v8/UserInteraction/WsFederationDynamicProviders/IdentityServerHost/wwwroot/js/signin-redirect.js index 6ebc5691c..172885be3 100755 --- a/IdentityServer/v8/UserInteraction/WsFederationDynamicProviders/IdentityServerHost/wwwroot/js/signin-redirect.js +++ b/IdentityServer/v8/UserInteraction/WsFederationDynamicProviders/IdentityServerHost/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})(); diff --git a/various/clients/Owin/IdentityServerHost/wwwroot/js/signin-redirect.js b/various/clients/Owin/IdentityServerHost/wwwroot/js/signin-redirect.js index bdfe877dd..172885be3 100644 --- a/various/clients/Owin/IdentityServerHost/wwwroot/js/signin-redirect.js +++ b/various/clients/Owin/IdentityServerHost/wwwroot/js/signin-redirect.js @@ -1 +1,31 @@ -window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url"); +"use strict"; + +(function () { + var meta = document.querySelector("meta[http-equiv=refresh]"); + if (!meta) { + console.error("Could not find meta tag for signin redirect."); + return; + } + + var redirectUrl = meta.getAttribute("data-url"); + if (!redirectUrl || !redirectUrl.trim()) { + console.error("No signin redirect URL found in meta tag."); + return; + } + + var url; + try { + url = new URL(redirectUrl, window.location.href); + } catch (error) { + console.error("Invalid signin redirect URL.", error); + return; + } + + // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S). + if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") { + console.error("Signin redirect URL has an unsafe scheme."); + return; + } + + window.location.href = url.href; +})();