Guard OAuth return pages against prototype pollution (#281)

vharseko · web-flow · commit f4cf7b691cd3 · 2026-07-22T09:18:48.000+03:00
* Guard query-param parsing against prototype pollution

oauthReturn.html and mockOAuthAuthorization.html built a queryParams
object by writing map[name] = value for every URL parameter, where the
name is user-controlled. A parameter named __proto__ (or constructor /
prototype) could therefore pollute Object.prototype (CodeQL
js/remote-property-injection, CWE-1321).

Skip those reserved names when populating the map. Legitimate parameters
(state, code, redirect_uri) are unaffected.

* Read OAuth query parameters by name (CodeQL js/remote-property-injection)

The __proto__/constructor/prototype blocklist added earlier is not
recognized as a sanitizer by CodeQL, and the alert covers any property
write keyed by user input, not just prototype pollution. Replace the
query-parameter map with a getQueryParam(name) helper so the pages only
read the parameters they use (state, code, redirect_uri) and never write
a property under a user-controlled name.

* Restrict mock OAuth redirect_uri to the current origin (CodeQL js/xss, js/client-side-unvalidated-url-redirection)

* Parse redirect_uri with the URL API instead of an anchor element

CodeQL flags assigning user input to an anchor's href as an XSS and
unvalidated-redirect sink (js/xss, js/client-side-unvalidated-url-redirection)
even though the element is detached and only used to parse the URL.
Use new URL() for parsing so no sink is involved, and reject a missing
redirect_uri explicitly instead of letting it resolve to "/undefined".

* Rebuild the mock redirect target from url.origin

The origin equality check has already passed at this point, so
url.origin + url.pathname is equivalent to the manual protocol/host
concatenation and reads clearer. Also document that any query or
fragment on the incoming redirect_uri is dropped deliberately - the
caller appends its own ?code=...&amp;state=... parameters.
diff --git a/ui/commons/src/main/resources/oauthReturn.html b/ui/commons/src/main/resources/oauthReturn.html
@@ -1,3 +1,6 @@
+<!-- Copyright 2015 ForgeRock AS.
+	License terms: https://forgerock.org/cddlv1-0/
+	Portions Copyrighted 2026 3A Systems, LLC -->
 <script>
 (function () {
     /**
@@ -14,15 +17,22 @@
         This step is necessary because IDPs do not allow you to specify a redirect URI with
         a hash fragment; this file works around that requirement.
     */
-    var queryParams = window.location.search.replace("?", "").split("&").reduce(function (map, item) {
+    // Look up a single query parameter by name. Reading only the known
+    // parameters avoids writing map entries keyed by user input (CWE-1321).
+    function getQueryParam(name) {
+        var value;
+        window.location.search.replace("?", "").split("&").forEach(function (item) {
             var parts = item.split("=");
-            map[parts[0]] = decodeURIComponent(parts[1]);
-            return map;
-        }, {});
+            if (parts[0] === name) {
+                value = decodeURIComponent(parts[1]);
+            }
+        });
+        return value;
+    }
 
     window.location.href = window.location.href
-        // queryParams.state is expected to be the URL fragment plus any other
+        // the "state" parameter is expected to be the URL fragment plus any other
         // details necessary to resume the oauth process
-        .replace(/oauthReturn\.html.*/, "#" + queryParams.state + "&code=" + queryParams.code);
+        .replace(/oauthReturn\.html.*/, "#" + getQueryParam("state") + "&code=" + getQueryParam("code"));
 }())
 </script>
diff --git a/ui/mock/src/main/resources/mockOAuthAuthorization.html b/ui/mock/src/main/resources/mockOAuthAuthorization.html
@@ -1,5 +1,8 @@
 
 
+<!-- Copyright 2015 ForgeRock AS.
+	License terms: https://forgerock.org/cddlv1-0/
+	Portions Copyrighted 2026 3A Systems, LLC -->
 <body>
 
 Mock OAuth Provider redirecting in <span id="countDown"></span>....
@@ -9,18 +12,55 @@
 
 <script>
 (function () {
-    var queryParams = window.location.search.replace("?", "").split("&").reduce(function (map, item) {
+    // Look up a single query parameter by name. Reading only the known
+    // parameters avoids writing map entries keyed by user input (CWE-1321).
+    function getQueryParam(name) {
+        var value;
+        window.location.search.replace("?", "").split("&").forEach(function (item) {
             var parts = item.split("=");
-            map[parts[0]] = decodeURIComponent(parts[1]);
-            return map;
-        }, {}),
-        countDown = 3;
+            if (parts[0] === name) {
+                value = decodeURIComponent(parts[1]);
+            }
+        });
+        return value;
+    }
 
-    setInterval(function () {
+    // The mock provider only ever redirects back into the application that
+    // initiated the flow, so resolve redirect_uri against the current
+    // document and rebuild it on our own origin. Cross-origin targets and
+    // non-http schemes (e.g. javascript:) are rejected (CWE-79, CWE-601).
+    function getSafeRedirectUri() {
+        var redirectUri = getQueryParam("redirect_uri");
+        if (!redirectUri) {
+            return undefined;
+        }
+        var url;
+        try {
+            url = new URL(redirectUri, window.location.href);
+        } catch (e) {
+            return undefined;
+        }
+        if (url.origin !== window.location.origin) {
+            return undefined;
+        }
+        // Any query or fragment on the incoming redirect_uri is dropped
+        // deliberately: the caller appends its own ?code=...&state=... below.
+        return url.origin + url.pathname;
+    }
+
+    var countDown = 3;
+
+    var timer = setInterval(function () {
         document.getElementById("countDown").innerHTML = countDown;
         countDown--;
         if (countDown <= 0) {
-            window.location.href=queryParams.redirect_uri + "?code=randomAccessCode&state=" + encodeURIComponent(queryParams.state);
+            clearInterval(timer);
+            var redirectUri = getSafeRedirectUri();
+            if (redirectUri) {
+                window.location.href=redirectUri + "?code=randomAccessCode&state=" + encodeURIComponent(getQueryParam("state"));
+            } else {
+                document.body.innerHTML = "Invalid redirect_uri";
+            }
         }
     }, 1000);
     document.getElementById("countDown").innerHTML = countDown+1;
