Enhace the Open Redirect meta redirect regexp (closes #75).

* Match the test URL when it ends with `?...`, `&...`, or `&...`. * Make the giant regex a little more readable. * Added more test cases to the specs.
ronin-rb · May 25, 2024 · 5a95758 · 5a95758
1 parent 7fa453a
commit 5a95758
Show file tree

Hide file tree

Showing 2 changed files with 469 additions and 4 deletions.
diff --git a/lib/ronin/vulns/open_redirect.rb b/lib/ronin/vulns/open_redirect.rb
@@ -95,10 +95,34 @@ def vulnerable?
                 http-equiv\s*=\s*(?: "refresh" | 'refresh' | refresh )\s+
                 content\s*=\s*
                 (?:
-                 "\s*\d+\s*;\s*url\s*=\s*(?: '\s*#{escaped_test_url}\s*' | #{escaped_test_url} )\s*"|
-                 '\s*\d+\s*;\s*url\s*=\s*(?: "\s*#{escaped_test_url}\s*" | #{escaped_test_url} )\s*'|
-                 \s*\d+;url=(?: "#{escaped_test_url}" | '#{escaped_test_url}' | #{escaped_test_url} )
-                )\s*
+                  # content="..."
+                  "\s*\d+\s*;\s*url\s*=\s*
+                  (?:
+                    # content="0; url='...'"
+                    '\s*#{escaped_test_url}(?:(?:\?|&(amp;)?)[^\s'"]+)?\s*' |
+                    # content="0; url=..."
+                    #{escaped_test_url}(?:(?:\?|&(amp;)?)[^\s"]+)?
+                  )\s*" |
+                  # content='...'
+                  '\s*\d+\s*;\s*url\s*=\s*
+                  (?:
+                    # content='0; url="..."'
+                    "\s*#{escaped_test_url}(?:(?:\?|&(amp;)?)[^\s"']+)?\s*" |
+                    # content='0; url=...'
+                    #{escaped_test_url}(?:(?:\?|&(amp;)?)[^\s']+)?
+                  )\s*' |
+                  # content=...
+                  \s*\d+;url=(?:
+                    # content=0;url="..."
+                    "\s*#{escaped_test_url}(?:(?:\?|&(amp;)?)[^\s"]+)?\s*" |
+                    # content=0;url='...'
+                    '\s*#{escaped_test_url}(?:(?:\?|&(amp;)?)[^\s']+)?\s*' |
+                    # content=0;url=...
+                    #{escaped_test_url}(?:(?:\?|&(amp;)?)[^\s/>]+)?
+                  )
+                )
+                \s*
+                # /> or / >
                 (?:/\s*)?>
             }xi