Fix an open redirect weakness in getLoginRedirect() (#795)

Because of how browsers handle the `Location` header, values beginning
with `\` can be leveraged to create redirect targets on other domains.

Thanks to Volker Dusch and the PHP Ecosystem security team for reporting this.

Author: markstory

src/AuthenticationService.php

@@ -398,15 +398,29 @@ public function getLoginRedirect(ServerRequestInterface $request): ?string
         ) {
             return null;
         }
+        $value = (string)$params[$redirectParam];
 
-        $parsed = parse_url((string)$params[$redirectParam]);
+        // In the `Location` header, Browsers normalize \ to /
+        // (see WHATWG URL Standard).
+        // We do the same to prevent injection via \ sequences.
+        $normalized = str_replace('\\', '/', $value);
+
+        // A leading run of `//` or `\\` are rejected
+        if (str_starts_with($normalized, '//')) {
+            return null;
+        }
+
+        $parsed = parse_url($normalized);
         if ($parsed === false) {
             return null;
         }
         if (!empty($parsed['host']) || !empty($parsed['scheme'])) {
             return null;
         }
         $parsed += ['path' => '/', 'query' => ''];
+        if (str_contains($parsed['path'], '\\')) {
+            return null;
+        }
         if (strlen($parsed['path']) && $parsed['path'][0] !== '/') {
             $parsed['path'] = '/' . $parsed['path'];
         }

tests/TestCase/AuthenticationServiceTest.php

@@ -822,7 +822,7 @@ public function testGetUnauthenticatedRedirectUrlWithBasePath(): void
         );
     }
 
-    public function testGetLoginRedirect(): void
+    public function testGetLoginRedirectInvalid(): void
     {
         $service = new AuthenticationService([
             'unauthenticatedRedirect' => '/users/login',
@@ -863,6 +863,39 @@ public function testGetLoginRedirect(): void
             '/path/with?query=string',
             $service->getLoginRedirect($request),
         );
+
+        $request = ServerRequestFactory::fromGlobals(
+            ['REQUEST_URI' => '/login'],
+            ['redirect' => '/\\evil.com'],
+        );
+        $this->assertNull(
+            $service->getLoginRedirect($request),
+        );
+
+        $request = ServerRequestFactory::fromGlobals(
+            ['REQUEST_URI' => '/login'],
+            ['redirect' => '\\/\\evil.com'],
+        );
+        $this->assertNull(
+            $service->getLoginRedirect($request),
+        );
+
+        $request = ServerRequestFactory::fromGlobals(
+            ['REQUEST_URI' => '/login'],
+            ['redirect' => '\\evil.com/path'],
+        );
+        $this->assertSame(
+            '/evil.com/path',
+            $service->getLoginRedirect($request),
+        );
+
+        $request = ServerRequestFactory::fromGlobals(
+            ['REQUEST_URI' => '/login'],
+            ['redirect' => '\\\\evil.com/path'],
+        );
+        $this->assertNull(
+            $service->getLoginRedirect($request),
+        );
     }
 
     /**