check sso whitelist in more places

Signed-off-by: Ben Berry <[email protected]>
cloudfoundry · May 29, 2020 · 839cc2f · 839cc2f
1 parent 4d33c4d
commit 839cc2f
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/src/jetstream/authuaa.go b/src/jetstream/authuaa.go
@@ -466,6 +466,14 @@ func (p *portalProxy) ssoLoginToUAA(c echo.Context) error {
 		state = fmt.Sprintf("%s/login?SSO_Message=%s", state, url.QueryEscape(msg))
 	}
 
+	if !safeSSORedirectState(state, p.Config.SSOWhiteList) {
+		err := interfaces.NewHTTPShadowError(
+			http.StatusUnauthorized,
+			"SSO Login: Disallowed redirect state",
+			"SSO Login: Disallowed redirect state")
+		return err
+	}
+
 	return c.Redirect(http.StatusTemporaryRedirect, state)
 }