Skip to content

Make Relative Redirect URI Absolute When Authorization Header Present #6325

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
daxian-dbw merged 1 commit into from
Mar 9, 2018
Merged

Make Relative Redirect URI Absolute When Authorization Header Present #6325

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion ...owerShell.Commands.Utility/commands/utility/WebCmdlet/Common/WebRequestPSCmdlet.Common.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1257,7 +1257,7 @@ internal virtual HttpResponseMessage GetResponse(HttpClient client, HttpRequestM

// recreate the HttpClient with redirection enabled since the first call suppressed redirection
using (client = GetHttpClient(false))
using (HttpRequestMessage redirectRequest = GetRequest(response.Headers.Location, stripAuthorization:true))
using (HttpRequestMessage redirectRequest = GetRequest(new Uri(request.RequestUri, response.Headers.Location), stripAuthorization:true))
{
FillRequestStream(redirectRequest);
_cancelToken = new CancellationTokenSource();
Expand Down
2 changes: 2 additions & 0 deletions test/powershell/Modules/Microsoft.PowerShell.Utility/WebCmdlets.Tests.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -363,6 +363,8 @@ $redirectTests = @(

@{redirectType = 'TemporaryRedirect'; redirectedMethod = 'GET'}
@{redirectType = 'RedirectKeepVerb'; redirectedMethod = 'GET'} # Synonym for TemporaryRedirect

@{redirectType = 'relative'; redirectedMethod = 'GET'}
Copy link
Member

@TravisEz13 TravisEz13 Mar 8, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

are the existing tests enough to verify that you are making the uri absolute?

Copy link
Contributor Author

@markekraus markekraus Mar 8, 2018 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure I understand what you are asking. But, if I were to role back the code change and leave the test, the test would fail. This one would be hard to verify directly without some kind of debug or test hook. Instead, I decided to test the behavior.

Since this bug identified awhile ago, I had WebListener set to always return absolute URIs for tests. I had to add an exception to that behavior now that it is fixed with the new type value.

Copy link
Member

@TravisEz13 TravisEz13 Mar 8, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This answers my question well enough

)

$PendingCertificateTest = $false
Expand Down
9 changes: 8 additions & 1 deletion test/tools/WebListener/Controllers/RedirectController.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,12 +30,19 @@ public IActionResult Index(int count)
url = $"{url}/Redirect/{nextHop}";
}

if (Request.Query.TryGetValue("type", out StringValues type) && Enum.TryParse(type.FirstOrDefault(), out HttpStatusCode status))
var typeIsPresent = Request.Query.TryGetValue("type", out StringValues type);

if (typeIsPresent && Enum.TryParse(type.FirstOrDefault(), out HttpStatusCode status))
{
Response.StatusCode = (int)status;
url = $"{url}?type={type.FirstOrDefault()}";
Response.Headers.Add("Location", url);
}
else if (typeIsPresent && String.Equals(type.FirstOrDefault(), "relative", StringComparison.InvariantCultureIgnoreCase))
{
url = new Uri($"{url}?type={type.FirstOrDefault()}").PathAndQuery;
Response.Redirect(url, false);
}
else
{
Response.Redirect(url, false);
Expand Down
1 change: 1 addition & 0 deletions test/tools/WebListener/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -489,6 +489,7 @@ Invoke-RestMethod -Uri $uri -Body $body -Method 'Put'

Will `302` redirect to `/Get/`. If a number is supplied, redirect will occur that many times. Can be used to test maximum redirects.
If the `type` query field is supplied the corresponding `System.Net.HttpStatusCode` will be returned instead of `302`.
If `type` is `relative`, the redirect URI will be relative instead of absolute.

```powershell
$uri = Get-WebListenerUrl -Test 'Redirect' -TestValue '2'
Expand Down