Skip to content
SudoSecurity

Sections

securitymedium

Stop the Open Redirect

150 points · 0 solved

A login page that blindly follows ?next= lets phishers bounce users to their own site. Line 1 lists the allowed hosts separated by spaces. Line 2 is T; each next line is a redirect target. Print ALLOW if it is either:

  • a same-site path: starts with /, does not start with // or /\, and contains no \ anywhere; or
  • an absolute https:// URL whose host (letters, digits, ., - only, compared case-insensitively) is exactly one of the allowed hosts, followed by nothing or by /, ? or # and anything.

Otherwise print DENY — that includes http://, javascript:, user-info like https://good.com@evil.com, and ports.

Example 1 input

sudosecurity.org
3
/welcome/?new=1
https://sudosecurity.org/supporters/
https://evil.example/phish

Expected output

ALLOW
ALLOW
DENY
Learn the technique/learn/secure-coding-in-practice

main.py