Context OAuth2ClientScriptService.authorize(configurationName, redirectURI) takes the URI the user is sent to once the authorization flow succeeds. DefaultOAuth2ClientManager.authorize stores it in the user's session as-is (OIDCClientConfiguration.setSuccessRedirectURI), and CallbackOIDCEndpoint redirects to it at the end of the flow. Nothing checks that this URI points inside the wiki, so any absolute URI is accepted and followed. This is not a security issue on its own: calling the script service requires script right, which already allows sending the page's viewers anywhere, and the OIDC authentication flow builds this URI server-side from the request. But it puts the whole burden on every calling application: one that passes a request parameter to authorize without checking it turns the end of the OAuth2 flow into an open redirect. Proposed improvement
- Validate the redirect URI in authorize with the platform's URLSecurityManager (trusted domains), or only accept URIs inside the wiki, and refuse it otherwise.
- Check it again in CallbackOIDCEndpoint before redirecting, so that a value stored by another path cannot bypass the check.
- Consider accepting a relative URI or a document reference, and document the expected value in the authorize javadoc.
|
