[5.x] Harden auth redirects (#14089)

Co-authored-by: Jason Varga <jason@pixelfear.com>

Author: duncanmcclean

src/Auth/ResetsPasswords.php

@@ -12,6 +12,7 @@
 use Illuminate\Support\Str;
 use Illuminate\Validation\Rules\Password as PasswordRules;
 use Illuminate\Validation\ValidationException;
+use Statamic\Facades\URL;
 
 /**
  * A copy of Illuminate\Auth\ResetsPasswords.
@@ -49,8 +50,10 @@ public function reset(Request $request)
         $validator = Validator::make($request->all(), $this->rules(), $this->validationErrorMessages());
 
         if (! $validator->passes()) {
-            $redirect = $request->has('_error_redirect')
-                ? redirect($request->input('_error_redirect'))
+            $errorRedirect = $request->input('_error_redirect');
+
+            $redirect = $errorRedirect && ! URL::isExternalToApplication($errorRedirect)
+                ? redirect($errorRedirect)
                 : back();
 
             return $redirect
@@ -173,8 +176,10 @@ protected function sendResetFailedResponse(Request $request, $response)
             ]);
         }
 
-        $redirect = $request->has('_error_redirect')
-            ? redirect($request->input('_error_redirect'))
+        $errorRedirect = $request->input('_error_redirect');
+
+        $redirect = $errorRedirect && ! URL::isExternalToApplication($errorRedirect)
+            ? redirect($errorRedirect)
             : back();
 
         return $redirect

src/Auth/SendsPasswordResetEmails.php

@@ -6,6 +6,7 @@
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Password;
 use Illuminate\Validation\ValidationException;
+use Statamic\Facades\URL;
 
 /**
  * A copy of Illuminate\Auth\SendsPasswordResetEmails.
@@ -85,8 +86,10 @@ protected function sendResetLinkResponse(Request $request, $response)
     {
         session()->flash('user.forgot_password.success', __(Password::RESET_LINK_SENT));
 
-        $redirect = $request->has('_redirect')
-            ? redirect($request->input('_redirect'))
+        $successRedirect = $request->input('_redirect');
+
+        $redirect = $successRedirect && ! URL::isExternalToApplication($successRedirect)
+            ? redirect($successRedirect)
             : back();
 
         return $request->wantsJson()
@@ -102,8 +105,10 @@ protected function sendResetLinkResponse(Request $request, $response)
      */
     protected function sendResetLinkFailedResponse(Request $request, $response)
     {
-        $redirect = $request->has('_error_redirect')
-            ? redirect($request->input('_error_redirect'))
+        $errorRedirect = $request->input('_error_redirect');
+
+        $redirect = $errorRedirect && ! URL::isExternalToApplication($errorRedirect)
+            ? redirect($errorRedirect)
             : back();
 
         if ($request->wantsJson()) {

src/Facades/Endpoint/URL.php

@@ -245,6 +245,29 @@ public function isExternal($url)
         return $isExternal;
     }
 
+    /**
+     * Check whether a URL is external to whole Statamic application.
+     */
+    public function isExternalToApplication(?string $url): bool
+    {
+        if (Str::startsWith($url, '//')) {
+            return true;
+        }
+
+        $urlDomain = parse_url($url, PHP_URL_HOST);
+        $currentRequestDomain = parse_url(url()->to('/'), PHP_URL_HOST);
+
+        return $urlDomain
+            ? Site::all()
+                ->map(fn ($site) => parse_url($site->absoluteUrl(), PHP_URL_HOST))
+                ->push($currentRequestDomain)
+                ->filter(fn ($siteDomain) => ! is_null($siteDomain))
+                ->unique()
+                ->filter(fn ($siteDomain) => $siteDomain === $urlDomain)
+                ->isEmpty()
+            : false;
+    }
+
     public function clearExternalUrlCache()
     {
         self::$externalUriCache = [];

src/Http/Controllers/CP/Auth/LoginController.php

@@ -7,6 +7,7 @@
 use Illuminate\Validation\ValidationException;
 use Statamic\Auth\ThrottlesLogins;
 use Statamic\Facades\OAuth;
+use Statamic\Facades\URL;
 use Statamic\Http\Controllers\CP\CpController;
 use Statamic\Http\Middleware\CP\RedirectIfAuthorized;
 use Statamic\Support\Str;
@@ -135,7 +136,9 @@ public function logout(Request $request)
 
         $request->session()->regenerateToken();
 
-        return redirect($request->redirect ?? '/');
+        $redirect = $request->redirect ?? '/';
+
+        return redirect(URL::isExternalToApplication($redirect) ? '/' : $redirect);
     }
 
     protected function getReferrer()

src/Http/Controllers/ForgotPasswordController.php

@@ -7,7 +7,6 @@
 use Statamic\Auth\Passwords\PasswordReset;
 use Statamic\Auth\SendsPasswordResetEmails;
 use Statamic\Exceptions\ValidationException;
-use Statamic\Facades\Site;
 use Statamic\Facades\URL;
 use Statamic\Http\Middleware\RedirectIfAuthenticated;
 
@@ -32,26 +31,11 @@ public function showLinkRequestForm()
     public function sendResetLinkEmail(Request $request)
     {
         if ($url = $request->_reset_url) {
-            $url = URL::makeAbsolute($url);
-
-            $urlDomain = parse_url($url, PHP_URL_HOST);
-            $currentRequestDomain = parse_url(url()->to('/'), PHP_URL_HOST);
-
-            $isExternal = $urlDomain
-                ? Site::all()
-                    ->map(fn ($site) => parse_url($site->absoluteUrl(), PHP_URL_HOST))
-                    ->push($currentRequestDomain)
-                    ->filter(fn ($siteDomain) => ! is_null($siteDomain))
-                    ->unique()
-                    ->filter(fn ($siteDomain) => $siteDomain === $urlDomain)
-                    ->isEmpty()
-                : false;
-
-            throw_if($isExternal, ValidationException::withMessages([
+            throw_if(URL::isExternalToApplication($url), ValidationException::withMessages([
                 '_reset_url' => trans('validation.url', ['attribute' => '_reset_url']),
             ]));
 
-            PasswordReset::resetFormUrl($url);
+            PasswordReset::resetFormUrl(URL::makeAbsolute($url));
         }
 
         return $this->traitSendResetLinkEmail($request);

src/Http/Controllers/OAuthController.php

@@ -8,6 +8,7 @@
 use Laravel\Socialite\Two\InvalidStateException;
 use Statamic\Exceptions\NotFoundHttpException;
 use Statamic\Facades\OAuth;
+use Statamic\Facades\URL;
 use Statamic\Support\Arr;
 use Statamic\Support\Str;
 
@@ -77,7 +78,9 @@ protected function successRedirectUrl()
 
         parse_str($query, $query);
 
-        return Arr::get($query, 'redirect', $default);
+        $redirect = Arr::get($query, 'redirect', $default);
+
+        return URL::isExternalToApplication($redirect) ? $default : $redirect;
     }
 
     protected function unauthorizedRedirectUrl()

src/Http/Controllers/ResetPasswordController.php

@@ -8,6 +8,7 @@
 use Statamic\Auth\Passwords\PasswordReset;
 use Statamic\Auth\ResetsPasswords;
 use Statamic\Contracts\Auth\User;
+use Statamic\Facades\URL;
 use Statamic\Http\Middleware\CP\RedirectIfAuthorized;
 
 class ResetPasswordController extends Controller
@@ -41,7 +42,11 @@ protected function resetFormTitle()
 
     public function redirectPath()
     {
-        return request('redirect') ?? route('statamic.site');
+        $redirect = request('redirect');
+
+        return $redirect && ! URL::isExternalToApplication($redirect)
+            ? $redirect
+            : route('statamic.site');
     }
 
     protected function setUserPassword($user, $password)

src/Http/Controllers/User/LoginController.php

@@ -4,6 +4,7 @@
 
 use Illuminate\Support\Facades\Auth;
 use Statamic\Auth\ThrottlesLogins;
+use Statamic\Facades\URL;
 use Statamic\Http\Controllers\Controller;
 use Statamic\Http\Requests\UserLoginRequest;
 
@@ -20,12 +21,18 @@ public function login(UserLoginRequest $request)
         }
 
         if (Auth::attempt($request->only('email', 'password'), $request->has('remember'))) {
-            return redirect($request->input('_redirect', '/'))->withSuccess(__('Login successful.'));
+            $redirect = $request->input('_redirect', '/');
+
+            return redirect(URL::isExternalToApplication($redirect) ? '/' : $redirect)->withSuccess(__('Login successful.'));
         }
 
         $this->incrementLoginAttempts($request);
 
-        $errorResponse = $request->has('_error_redirect') ? redirect($request->input('_error_redirect')) : back();
+        $errorRedirect = $request->input('_error_redirect');
+
+        $errorResponse = $errorRedirect && ! URL::isExternalToApplication($errorRedirect)
+            ? redirect($errorRedirect)
+            : back();
 
         return $errorResponse->withInput()->withErrors(__('Invalid credentials.'));
     }
@@ -34,7 +41,9 @@ public function logout()
     {
         Auth::logout();
 
-        return redirect(request()->get('redirect', '/'));
+        $redirect = request()->get('redirect', '/');
+
+        return redirect(URL::isExternalToApplication($redirect) ? '/' : $redirect);
     }
 
     protected function username()

src/Http/Controllers/User/PasswordController.php

@@ -3,6 +3,7 @@
 namespace Statamic\Http\Controllers\User;
 
 use Illuminate\Support\Facades\Password;
+use Statamic\Facades\URL;
 use Statamic\Facades\User;
 use Statamic\Http\Requests\UserPasswordRequest;
 
@@ -21,7 +22,8 @@ public function __invoke(UserPasswordRequest $request)
 
     private function successfulResponse()
     {
-        $response = request()->has('_redirect') ? redirect(request()->get('_redirect')) : back();
+        $redirect = request()->get('_redirect');
+        $response = $redirect && ! URL::isExternalToApplication($redirect) ? redirect($redirect) : back();
 
         if (request()->ajax() || request()->wantsJson()) {
             return response([

src/Http/Controllers/User/ProfileController.php

@@ -2,6 +2,7 @@
 
 namespace Statamic\Http\Controllers\User;
 
+use Statamic\Facades\URL;
 use Statamic\Facades\User;
 use Statamic\Http\Requests\UserProfileRequest;
 
@@ -26,7 +27,8 @@ public function __invoke(UserProfileRequest $request)
 
     private function successfulResponse()
     {
-        $response = request()->has('_redirect') ? redirect(request()->get('_redirect')) : back();
+        $redirect = request()->get('_redirect');
+        $response = $redirect && ! URL::isExternalToApplication($redirect) ? redirect($redirect) : back();
 
         if (request()->ajax() || request()->wantsJson()) {
             return response([