Fixed an open redirect issue reported by @Fushuling GHSA-h5g6-xmh4-hc37

Author: akclace

CHANGELOG.md

@@ -7,10 +7,16 @@ This project uses [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
-### Added
+## [v0.17.7] - 2026-06-02
+
+### Security
+
+- Fixed an open redirect issue reported by @Fushuling https://github.com/openrundev/openrun/security/advisories/GHSA-h5g6-xmh4-hc37
 
 ## [v0.17.6] - 2026-06-01
 
+### Added
+
 - Added Windows Service Control Manager support for `openrun server start`, allowing OpenRun to run as a native Windows service registered with `sc.exe`.
 
 ## [v0.17.5] - 2026-05-28

internal/app/handler.go

@@ -114,6 +114,9 @@ func (a *App) validatedRefererRedirect(r *http.Request, referrer string) (string
 	if redirectTarget == "" {
 		redirectTarget = "/"
 	}
+	if strings.HasPrefix(redirectTarget, "//") {
+		return "", false
+	}
 	if refURL.RawQuery != "" {
 		redirectTarget += "?" + refURL.RawQuery
 	}

internal/app/tests/fragment_test.go

@@ -330,6 +330,16 @@ def handler(req):
 	testutil.AssertEqualsInt(t, "code", http.StatusSeeOther, response.Code)
 	testutil.AssertEqualsString(t, "redirect", "/test/abc?q=1#frag", response.Header().Get("Location"))
 
+	request = httptest.NewRequest("POST", "/test/abc/frag", nil)
+	request.Header.Set("Referer", "http://example.com//evil.com")
+	response = httptest.NewRecorder()
+	a.ServeHTTP(response, request)
+
+	// Same-origin referer with a network-path redirect target is ignored.
+	testutil.AssertEqualsInt(t, "code", http.StatusOK, response.Code)
+	testutil.AssertEqualsString(t, "body", "Template main myvalue.  fragdata myvalue2 ", response.Body.String())
+	testutil.AssertEqualsString(t, "redirect", "", response.Header().Get("Location"))
+
 	request = httptest.NewRequest("POST", "/test/abc/frag", nil)
 	request.Header.Set("Referer", "http://evil.com/test/abc")
 	response = httptest.NewRecorder()