From b3b9b227e795a56e76970011cb09c15d15140c73 Mon Sep 17 00:00:00 2001
From: alokhyland <Alok.Ranjan@Hyland.com>
Date: Mon, 10 Jun 2024 15:29:18 +0530
Subject: [PATCH] WEBUI-1511: Own Code Static Scan : Open Redirect

---
 elements/routing.js                           | 38 ++++++++++++++++++-
 .../resources/OSGI-INF/web-ui-properties.xml  |  3 ++
 2 files changed, 40 insertions(+), 1 deletion(-)

diff --git a/elements/routing.js b/elements/routing.js
index 6585010dea..1c3037cce8 100644
--- a/elements/routing.js
+++ b/elements/routing.js
@@ -27,6 +27,36 @@ function scrollToTop(ctx, next) {
   next();
 }
 
+function createUrlFromString(str) {
+  const httpRegex = /^https?:\/\//;
+  const wwwRegex = /www\./;
+  str = httpRegex.test(str) ? str : `http://${str}`;
+  str = wwwRegex.test(str) ? str : str.replace(/^(https?:\/\/)?/, '$1www.');
+  return str;
+}
+
+function isTrustedDomain(path) {
+  const trustedDomains = Nuxeo && Nuxeo.UI && Nuxeo.UI.config && Nuxeo.UI.config.trustedDomains;
+  if (!trustedDomains) return true;
+  const modifiedPathUrl = createUrlFromString(path);
+  const pathUrl = new URL(modifiedPathUrl);
+  const { hostname: userHostName } = pathUrl;
+  const trustedDomainList = trustedDomains.split(',');
+  const isValidUrl = trustedDomainList.some((url) => {
+    const updatedUrl = createUrlFromString(url);
+    const { hostname: currentUrlHostName } = new URL(updatedUrl);
+    return currentUrlHostName?.toLowerCase() === userHostName?.toLowerCase();
+  });
+  return isValidUrl;
+}
+
+function encodeQueryParams(path) {
+  const pathUrl = new URL(path);
+  const queryParams = pathUrl.search.split('?')[1];
+  const encodepath = queryParams ? `${pathUrl.origin}?${encodeURIComponent(queryParams)}` : path;
+  return encodepath;
+}
+
 function _routeAdmin(selectedAdminTab, errorPath, routeData) {
   const hasPermission =
     app.currentUser.isAdministrator || app.currentUser.extendedGroups.find((grp) => grp.name === 'powerusers');
@@ -196,7 +226,13 @@ app.router = {
     }
     const isFullpath = /^http(s)?:\/\//.test(path);
     if (isFullpath) {
-      window.location = path;
+      const isValidUrl = isTrustedDomain(path);
+      if (isValidUrl) {
+        const encodepath = encodeQueryParams(path);
+        const link = document.createElement('a');
+        link.setAttribute('href', encodepath);
+        link.click();
+      }
     } else {
       page(path);
     }
diff --git a/plugin/web-ui/addon/src/main/resources/OSGI-INF/web-ui-properties.xml b/plugin/web-ui/addon/src/main/resources/OSGI-INF/web-ui-properties.xml
index cf0b597912..8c14b3ed55 100644
--- a/plugin/web-ui/addon/src/main/resources/OSGI-INF/web-ui-properties.xml
+++ b/plugin/web-ui/addon/src/main/resources/OSGI-INF/web-ui-properties.xml
@@ -51,5 +51,8 @@
     <!-- Properties to be fetched when loading the user object in user management, default is empty -->
     <property name="org.nuxeo.web.ui.user.management.fetch.document" list="true"></property>
 
+    <!-- allowed url to redirect -->
+    <property name="org.nuxeo.web.ui.trustedDomains">${org.nuxeo.web.ui.trustedDomains:=''}</property>
+
   </extension>
 </component>
\ No newline at end of file