An Open Redirect Guard That Rebuilt What It Rejected
Code: Megapixel99/CAS-Authentication-User Eight days ago I wrote that npm audit had never seen the worst bug in my own package. I closed that post on the question I thought would have caught it: given that nobody has audited this code, what would I find if I read the places where it hands user input to something that acts on it. I asked it, I found an open redirect on the login route, and 0.3.0…
In a recent incident, security researcher Megapixel99 discovered two open redirects in the npm package CAS-Authentication-User. The vulnerable code accepted user input and directed it to a destination without proper validation. A second open redirect was found shortly after the initial fix, bringing the total to two. The package was vulnerable because the sink, or the point where user input was used, was not adequately checked, allowing attackers to redirect users to malicious sites.
The fix in version 0.4.0 improved the situation by using the WHATWG URL API to parse request URLs, which resolved any issues with bad URLs. This change ensured that only legitimate paths were accepted, effectively closing the vulnerability.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
