10 · Redirect และไฟล์

# Rails 7.0+ default: raise_on_open_redirects = true
redirect_to params[:next]                         # raises for foreign hosts
redirect_to params[:next], allow_other_host: true  # opts out: never with user input

# keep "return to" on our own site
redirect_to url_from(params[:next]) || root_path

function safeNext(next) {
  // resolve against our own origin, then require the same origin
  try {
    const u = new URL(next, "https://bank.test");
    if (u.origin !== "https://bank.test") return "/";
    return u.pathname + u.search + u.hash;      // relative, same-site
  } catch { return "/"; }
}
app.get("/after-login", (req, res) => res.redirect(safeNext(req.query.next)));

# Django ships a helper for exactly this
from django.utils.http import url_has_allowed_host_and_scheme

def after_login(request):
    nxt = request.GET.get("next", "/")
    if not url_has_allowed_host_and_scheme(nxt, allowed_hosts={request.get_host()},
                                           require_https=request.is_secure()):
        nxt = "/"
    return redirect(nxt)

# VULNERABLE
def download
  send_file Rails.root.join("files", params[:name])
end
# GET /download?name=../config/master.key  → serves your master key

// VULNERABLE
app.get("/download", (req, res) =>
  res.sendFile(path.join(__dirname, "files", req.query.name)));
// GET /download?name=../.env   → serves your secrets

# VULNERABLE
@app.get("/download")
def download():
    return send_file(os.path.join("files", request.args["name"]))
# GET /download?name=../.env   → serves your secrets

BASE = Rails.root.join("files").realpath

def download
  path = BASE.join(params[:name].to_s).expand_path
  return head :not_found unless path.to_s.start_with?("#{BASE}/") && path.file?
  send_file path
end

# better: Active Storage record, authorized first
def show
  doc = current_user.documents.find(params[:id])
  redirect_to rails_blob_path(doc.file, disposition: "attachment")
end

const BASE = path.resolve(__dirname, "files") + path.sep;
app.get("/download", (req, res) => {
  const target = path.resolve(BASE, String(req.query.name));
  if (!target.startsWith(BASE)) return res.sendStatus(404);   // escaped the folder
  res.sendFile(target);
});
// Express's res.sendFile(name, { root: BASE }) also rejects "../" escapes.

from pathlib import Path
BASE = Path("files").resolve()

@app.get("/download")
def download():
    target = (BASE / request.args["name"]).resolve()
    if not target.is_relative_to(BASE):          # Python 3.9+
        abort(404)
    return send_file(target)
# Flask's send_from_directory(BASE, name) performs this check for you.