Redirect to other Domain possible

[revoltek-daniel]

Hello,

the ?_redirect= Parameter supports "https:///evil.host" as parameter and redirects to this host.

This could be a possible security issue. https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html

I would suggest to add an check if the hostname (if one is available) in the redirect url matches the current one or add an possible allow list for users who needed different domains.

Something like

$host = \parse_url($redirect->getTargetUrl(), \PHP_URL_HOST);

if ($host === null || $host === $request->getHost()) {
    return new RedirectResponse($redirect);
}

throw new \InvalidArgumentException('Redirect target host must be the same as the request host.');