[6.x] Harden auth redirects (#14093)

Author: jasonvarga

src/Http/Controllers/CP/Auth/PasskeyLoginController.php

@@ -6,6 +6,7 @@
 use Illuminate\Support\Facades\Auth;
 use Statamic\Auth\WebAuthn\Serializer;
 use Statamic\Contracts\Auth\User as UserContract;
+use Statamic\Facades\URL;
 use Statamic\Facades\WebAuthn;
 use Statamic\Support\Str;
 
@@ -43,6 +44,8 @@ private function successRedirectUrl()
     {
         $referer = request('referer');
 
-        return Str::contains($referer, '/'.config('statamic.cp.route')) ? $referer : cp_route('index');
+        return Str::contains($referer, '/'.config('statamic.cp.route')) && ! URL::isExternalToApplication($referer)
+            ? $referer
+            : cp_route('index');
     }
 }

src/Http/Controllers/TwoFactorChallengeController.php

@@ -8,6 +8,7 @@
 use Inertia\Inertia;
 use Statamic\Events\TwoFactorAuthenticationFailed;
 use Statamic\Events\ValidTwoFactorAuthenticationCodeProvided;
+use Statamic\Facades\URL;
 use Statamic\Http\Middleware\CP\HandleInertiaRequests;
 use Statamic\Http\Middleware\RedirectIfAuthenticated;
 use Statamic\Http\Requests\TwoFactorChallengeRequest;
@@ -67,6 +68,10 @@ protected function formAction()
 
     protected function redirectPath()
     {
-        return request('redirect') ?? route('statamic.site');
+        $redirect = request('redirect');
+
+        return $redirect && ! URL::isExternalToApplication($redirect)
+            ? $redirect
+            : route('statamic.site');
     }
 }

src/Http/Controllers/TwoFactorSetupController.php

@@ -4,6 +4,7 @@
 
 use Illuminate\Http\Request;
 use Inertia\Inertia;
+use Statamic\Facades\URL;
 use Statamic\Facades\User;
 use Statamic\Http\Middleware\CP\HandleInertiaRequests;
 
@@ -31,7 +32,11 @@ public function __invoke(Request $request)
 
     protected function redirectPath()
     {
-        return request('redirect') ?? route('statamic.site');
+        $redirect = request('redirect');
+
+        return $redirect && ! URL::isExternalToApplication($redirect)
+            ? $redirect
+            : route('statamic.site');
     }
 
     protected function routes($user): array

tests/Feature/Auth/PasskeyLoginTest.php

@@ -122,6 +122,21 @@ public function it_does_not_redirect_to_non_cp_referer()
         $this->assertAuthenticatedAs($user);
     }
 
+    #[Test]
+    public function it_does_not_redirect_to_external_cp_referer()
+    {
+        $user = $this->createUser();
+        WebAuthn::shouldReceive('getUserFromCredentials')->once()->andReturn($user);
+        WebAuthn::shouldReceive('validateAssertion')->once()->andReturnTrue();
+
+        $this
+            ->loginRequest(['referer' => 'https://evil.com/cp/collections'])
+            ->assertOk()
+            ->assertJson(['redirect' => cp_route('index')]);
+
+        $this->assertAuthenticatedAs($user);
+    }
+
     #[Test]
     public function it_fails_when_validation_throws_exception()
     {

tests/Feature/Users/TwoFactorChallengeTest.php

@@ -191,6 +191,23 @@ public function it_redirects_to_intended_url_after_successful_challenge()
         $this->assertAuthenticatedAs($user);
     }
 
+    #[Test]
+    public function it_does_not_redirect_to_external_url_on_frontend_route()
+    {
+        $user = $this->userWithTwoFactorEnabled();
+
+        $this
+            ->session(['login.id' => $user->id()])
+            ->post(route('statamic.two-factor-challenge', [
+                'redirect' => 'https://evil.com',
+            ]), [
+                'code' => $this->getOneTimeCode($user),
+            ])
+            ->assertRedirect(route('statamic.site'));
+
+        $this->assertAuthenticatedAs($user);
+    }
+
     #[Test]
     public function the_session_is_elevated_upon_login()
     {

tests/Feature/Users/TwoFactorSetupTest.php

@@ -45,6 +45,17 @@ public function redirect_url_is_referer()
             ->assertInertia(fn ($page) => $page->where('redirect', 'http://localhost/cp/collections'));
     }
 
+    #[Test]
+    public function it_does_not_redirect_to_external_url_on_frontend_route()
+    {
+        $this
+            ->actingAs($this->userWithTwoFactorEnabled())
+            ->get(route('statamic.two-factor-setup', [
+                'redirect' => 'https://evil.com',
+            ]))
+            ->assertRedirect(route('statamic.site'));
+    }
+
     private function user()
     {
         return tap(User::make()->makeSuper())->save();