From 1e3ac518692ef8d846513d781a2b72044d255dfd Mon Sep 17 00:00:00 2001
From: zjf <1799650030@qq.com>
Date: Wed, 20 Aug 2025 10:50:36 +0800
Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=E6=BC=8F=E6=B4=9E?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../handler/SsoLogoutSuccessHandler.java      | 43 +++++++++++++++++--
 pom.xml                                       |  2 +-
 2 files changed, 40 insertions(+), 5 deletions(-)

diff --git a/pjcloud-common/pjcloud-common-security/src/main/java/com/bsd/pjcloud/common/security/handler/SsoLogoutSuccessHandler.java b/pjcloud-common/pjcloud-common-security/src/main/java/com/bsd/pjcloud/common/security/handler/SsoLogoutSuccessHandler.java
index a1b82fc72..eb1aeecdc 100644
--- a/pjcloud-common/pjcloud-common-security/src/main/java/com/bsd/pjcloud/common/security/handler/SsoLogoutSuccessHandler.java
+++ b/pjcloud-common/pjcloud-common-security/src/main/java/com/bsd/pjcloud/common/security/handler/SsoLogoutSuccessHandler.java
@@ -8,6 +8,9 @@ import org.springframework.security.web.authentication.logout.LogoutSuccessHandl
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
 import java.io.IOException;
+import java.net.URI;
+import java.net.URISyntaxException;
+import java.util.Set;
 
 /**
  * @author pjcloud
@@ -19,21 +22,53 @@ public class SsoLogoutSuccessHandler implements LogoutSuccessHandler {
 
 	private static final String REDIRECT_URL = "redirect_url";
 
+	// 定义允许重定向的域名白名单
+	//todo 如果使用需要进行可配置话操作
+	private static final Set<String> ALLOWED_DOMAINS = Set.of(
+			"localhost",
+			"127.0.0.1"
+	);
+
 	@Override
 	public void onLogoutSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication)
 			throws IOException {
 
-		// 获取请求参数中是否包含 回调地址
 		String redirectUrl = request.getParameter(REDIRECT_URL);
 		String referer = request.getHeader(HttpHeaders.REFERER);
 
-		if (StrUtil.isNotBlank(redirectUrl)) {
+		// 修复漏洞1：验证redirect_url参数
+		if (StrUtil.isNotBlank(redirectUrl) && isUrlSafe(redirectUrl)) {
 			response.sendRedirect(redirectUrl);
 		}
-		else if (StrUtil.isNotBlank(referer)) {
-			// 默认跳转referer 地址
+		// 修复漏洞2：验证Referer头
+		else if (StrUtil.isNotBlank(referer) && isUrlSafe(referer)) {
 			response.sendRedirect(referer);
 		}
+		else {
+			// 默认重定向到安全页面
+			response.sendRedirect("/login");
+		}
 	}
 
+	private boolean isUrlSafe(String url) {
+		try {
+			// 检查是否是相对URL
+			if (url.startsWith("/") || url.startsWith("./") || url.startsWith("../")) {
+				return true; // 相对URL是安全的
+			}
+
+			URI uri = new URI(url);
+			String host = uri.getHost();
+
+			// 检查是否在白名单中
+			if (host != null) {
+				return ALLOWED_DOMAINS.contains(host.toLowerCase());
+			}
+
+			return false; // 无效URL
+
+		} catch (URISyntaxException e) {
+			return false; // 无效URL
+		}
+	}
 }
diff --git a/pom.xml b/pom.xml
index cf4a3c0d3..32f11c842 100644
--- a/pom.xml
+++ b/pom.xml
@@ -116,7 +116,7 @@
         <module>pjcloud-common</module>
         <module>pjcloud-flow</module>
         <module>pjcloud-visual</module>
-        <module>pjcloud-app-server</module>
+<!--        <module>pjcloud-app-server</module>-->
         <module>pjcloud-thirdparty</module>
         <module>pjcloud-canteen</module>
         <module>pjcloud-integrated</module>