OTWO-7717 Open redirect via referer header redirect_back uses allow_o…

app/controllers/application_controller.rb

@@ -209,6 +209,7 @@ def store_location
   end
 
   def redirect_to_saved_path(default = root_path, **args)
+    args[:allow_other_host] = false
     redirect_back(fallback_location: session[:return_to] || default, **args)
     session[:return_to] = nil
   end

app/controllers/concerns/org_filters.rb

@@ -80,7 +80,7 @@ def can_claim_project
   def org_must_be_edit_authorized
     return if logged_in? && @organization.edit_authorized?
 
-    redirect_back fallback_location: @organization, notice: t('.unauthorized')
+    redirect_back fallback_location: @organization, notice: t('.unauthorized'), allow_other_host: false
   end
 
   def set_project

app/controllers/projects_controller.rb

@@ -75,7 +75,7 @@ def report_outdated
       ProjectMailer.report_outdated(current_user, @project).deliver
     end
     flash[:notice] = t('.notification')
-    redirect_back(fallback_location: root_path)
+    redirect_back(fallback_location: root_path, allow_other_host: false)
   end
 
   private

test/controllers/application_controller_test.rb

@@ -251,6 +251,20 @@ class ApplicationControllerTest < ActionController::TestCase
 
       Rails.application.config.unstub(:consider_all_requests_local)
     end
+
+    describe '#redirect_to_saved_path' do
+      it 'must redirect to fallback when Referer is an external host' do
+        @request.env['HTTP_REFERER'] = 'https://evil.com/phishing'
+        get :redirect_to_saved_path_action
+        assert_redirected_to root_path
+      end
+
+      it 'must follow Referer when it is the same host' do
+        @request.env['HTTP_REFERER'] = 'http://test.host/accounts'
+        get :redirect_to_saved_path_action
+        assert_redirected_to 'http://test.host/accounts'
+      end
+    end
   end
 
   describe 'ProjectsController' do
@@ -396,6 +410,10 @@ def throws_fisbot_api_error
   def throws_missing_template
     raise ActionView::MissingTemplate.new(%w[path1 path2], 'template_name', %w[detail1 detail2], false, 'html')
   end
+
+  def redirect_to_saved_path_action
+    redirect_to_saved_path
+  end
 end
 
 test_routes = proc do
@@ -408,5 +426,6 @@ def throws_missing_template
   get 'test/throws_standard_error' => 'test#throws_standard_error'
   get 'test/throws_fisbot_api_error' => 'test#throws_fisbot_api_error'
   get 'test/throws_missing_template' => 'test#throws_missing_template'
+  get 'test/redirect_to_saved_path_action' => 'test#redirect_to_saved_path_action'
 end
 Rails.application.routes.send(:eval_block, test_routes)

test/controllers/organizations_controller_test.rb

@@ -356,6 +356,16 @@ class OrganizationsControllerTest < ActionController::TestCase
       _(flash[:notice]).must_equal I18n.t('organizations.unauthorized')
       _(project.reload.organization_id).must_equal organization.id
     end
+
+    it 'must redirect to organization fallback, not external Referer, when unauthorized' do
+      restrict_edits_to_managers(organization)
+      project = create(:project, name: 'test name1', organization_id: organization.id)
+      @request.env['HTTP_REFERER'] = 'https://evil.com/phishing'
+
+      put :remove_project, params: { id: organization.to_param, project_id: project.id, source: 'claim_projects_list' }
+
+      assert_redirected_to organization_path(organization)
+    end
   end
 
   describe 'new_manager' do

test/controllers/projects_controller_test.rb

@@ -1080,6 +1080,18 @@ class ProjectsControllerTest < ActionController::TestCase
       _(flash[:notice]).must_equal I18n.t('projects.report_outdated.notification')
       _(project.reload.reported_at).wont_be_nil
     end
+
+    it 'must redirect to fallback when Referer is an external host' do
+      @request.env['HTTP_REFERER'] = 'https://evil.com/phishing'
+      put :report_outdated, params: { id: project.id }
+      assert_redirected_to root_path
+    end
+
+    it 'must redirect to Referer when it is the same host' do
+      @request.env['HTTP_REFERER'] = 'http://test.host/p/metro-1'
+      put :report_outdated, params: { id: project.id }
+      assert_redirected_to 'http://test.host/p/metro-1'
+    end
   end
 end