Add back-link sanitization on logout page

auth/handlers/handle_logout.go

@@ -22,10 +22,10 @@ func (h *AuthHandlers) logoutProc(req *request.AuthReq) (err error) {
 
 	req.Template = TmplLogout
 
-	if req.Request.FormValue("back") != "" {
-		req.Data["link"] = req.Request.FormValue("back")
-	} else {
-		req.Data["link"] = GetLinks().Login
+	req.Data["link"] = GetLinks().Login
+
+	if bl := req.Request.FormValue("back"); bl != "" {
+		req.Data["link"] = sanitizeLink(bl)
 	}
 
 	return

auth/handlers/handle_logout_test.go

@@ -35,7 +35,7 @@ func Test_logoutProc(t *testing.T) {
 	authReq = prepareClientAuthReq(authHandlers, req, user)
 
 	req.PostForm = url.Values{}
-	req.PostForm.Add("back", "/back")
+	req.PostForm.Add("back", "\"><script>alert(origin)</script><\"")
 	authReq.Session.Values = map[interface{}]interface{}{"key": url.Values{"key": []string{"value"}}}
 
 	err := authHandlers.logoutProc(authReq)
@@ -43,6 +43,6 @@ func Test_logoutProc(t *testing.T) {
 	rq.Empty(authReq.Session.Values)
 	rq.Empty(authReq.AuthUser)
 	rq.Empty(authReq.Client)
-	rq.Equal("/back", authReq.Data["link"])
+	rq.Equal("scriptalert(origin)/script", authReq.Data["link"])
 	rq.Equal(TmplLogout, authReq.Template)
 }

auth/handlers/links.go

@@ -1,6 +1,9 @@
 package handlers
 
-import "strings"
+import (
+	"regexp"
+	"strings"
+)
 
 type (
 	Links struct {
@@ -49,7 +52,10 @@ type (
 	}
 )
 
-var BasePath string = "/"
+var (
+	invalidLinkChars        = regexp.MustCompile(`[^-A-Za-z0-9+&@#/%?=~_|!:,.;\\(\\)]`)
+	BasePath         string = "/"
+)
 
 func GetLinks() Links {
 	var b = strings.TrimSuffix(BasePath, "/") + "/"
@@ -104,3 +110,7 @@ func tbp(s string) string {
 
 	return s
 }
+
+func sanitizeLink(l string) string {
+	return invalidLinkChars.ReplaceAllString(l, "")
+}