vrr/agent-zero
2
0
Fork 0
mirror of https://github.com/agent0ai/agent-zero.git synced 2026-07-10 01:18:29 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

fix(security): prevent open redirect on login redirect

Browse source 
Login redirect responses are followed without validating the target
origin. An attacker who can influence the redirect URL could send
users to a malicious domain.

Add origin validation before following the redirect in both
fetchApi() and getCsrfToken() — only follow if the redirect URL
origin matches window.location.origin.

Severity: Medium
This commit is contained in:
Deimos AI 2026-02-26 13:50:41 +00:00 • committed by Demo User
parent 27730153ac
commit da24eb04e0
1 changed files with 10 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

14
webui/js/api.js
View file

@ -129,8 +129,11 @@ export async function fetchApi(url, request) {
csrfToken = null;
return await _wrap(false);
} else if (finalResponse.redirected && finalResponse.url.endsWith("/login")) {
// redirect to login
window.location.href = finalResponse.url;
// redirect to login (origin check prevents open redirect)
const _redirectUrl = new URL(finalResponse.url);
if (_redirectUrl.origin === window.location.origin) {
window.location.href = finalResponse.url;
}
return;
}
@ -218,8 +221,11 @@ export async function getCsrfToken() {
}
if (response.redirected && response.url.endsWith("/login")) {
// redirect to login
window.location.href = response.url;
// redirect to login (origin check prevents open redirect)
const _redirectUrl = new URL(response.url);
if (_redirectUrl.origin === window.location.origin) {
window.location.href = response.url;
}
return;
}
const json = await response.json();