net/http: Redirect hardening

[neild]

The http.Redirect function writes a 3xx redirect to a ResponseWriter.

Redirect takes a URL parameter, of type string. The URL parameter has only minimal sanitization applied, and is not safe for use with attacker-controlled inputs.

One example of possibly-surprising behavior is that a redirect to \\example.com is a relative-path reference according to RFC 3986, but will be interpreted by most browsers as a network-path reference. /\example.com is an absolute-path reference according to the RFC, but will also be interpreted by browsers as a network-path reference. (Thanks to Jingcheng Yang (Sichuan University), Enze Wang@IPASSLAB(@zer0yu), Jianjun Chen (Tsinghua University & Zhongguancun Laboratory) for reporting this case.)

We should document that Redirect does not sanitize its URL parameter. Users who wish to use Redirect with untrusted URLs should parse the URL with net/url, perform whatever validation they may wish, and then reassemble the parsed and validated URL into a string with net/url.URL.String.

We should also consider, as a hardening measure, %-encoding backslashes at the start of Redirect's URL parameter to prevent browsers from interpreting them as part of an absolute-path reference.

[gabyhelp]

Related Issues

• net/http: Redirect HTML encodes path rather than URL encoding #14115 (closed)
• net/http: Redirect only sanitizes relative but not absolute URIs #23961 (closed)
• net/http: add more flexible Redirect #25166 (closed)

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[gopherbot]

Change https://go.dev/cl/640918 mentions this issue: net/http: escape leading \s in Redirect targets

[gopherbot]

Change https://go.dev/cl/640917 mentions this issue: net/http: document that Redirect does not sanitize its url

[zer0yu]

Thank you for addressing this issue and for implementing the fix!

[P3ngu1nW]

Thank you for addressing this issue and implementing the proposed fixes.
Since this issue has been tagged as Security, I would like to inquire if it would be possible to assign a CVE (Common Vulnerabilities and Exposures) ID to this vulnerability for tracking purposes. A CVE would help ensure the issue is properly documented and referenced in security advisories.
Looking forward to your thoughts on this.