liz/wikijs-fork
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix: Open Redirect Vulnerability Mitigation - CWE 601 (#1963)

Browse Source 
* Open redirect vulnerabilty mitigation

* Refacted Open Redirect to user configurable and corrected incorrect security variable names.

Co-authored-by: danallendds <daniel.allen@friends.dds.mil>
This commit is contained in:
daneallen
2020-05-29 18:24:20 -04:00
committed by GitHub
parent 4b93e04261
commit 20e6bc1a70
5 changed files with 27 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
server/middlewares/security.js
View File

@@ -13,7 +13,7 @@ module.exports = function (req, res, next) {
req.app.disable('x-powered-by')
// -> Disable Frame Embedding
if (WIKI.config.securityIframe) {
if (WIKI.config.security.securityIframe) {
res.set('X-Frame-Options', 'deny')
}
@@ -27,14 +27,20 @@ module.exports = function (req, res, next) {
res.set('X-UA-Compatible', 'IE=edge')
// -> Disables referrer header when navigating to a different origin
if (WIKI.config.securityReferrerPolicy) {
if (WIKI.config.security.securityReferrerPolicy) {
res.set('Referrer-Policy', 'same-origin')
}
// -> Enforce HSTS
if (WIKI.config.securityHSTS) {
if (WIKI.config.security.securityHSTS) {
res.set('Strict-Transport-Security', `max-age=${WIKI.config.securityHSTSDuration}; includeSubDomains`)
}
// -> Prevent Open Redirect from user provided URL
if (WIKI.config.security.securityOpenRedirect) {
// Strips out all repeating / character in the provided URL
req.url = req.url.replace(/(\/)(?=\/*\1)/g, "")
}
return next()
}