Update webserver.js - allow saml relaystate in POST request (#6685)
added check for relaystate saml and regex check added in rest of allowed params correct formatting on regex string - now evaluates correctly set relaystate on get request check for ipv6
nmmclwhitehead committed
Jan 26, 2025 at 09:42 UTC
3ee06abfe8eece243ea1479e4639cdaedc210565
1 file changed
+36
webserver.js
+36
@@ -2837,6 +2837,38 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
2837
res.set('Content-Type', 'text/html');
2838
let url = domain.url;
2839
if (Object.keys(req.query).length > 0) { url += "?" + Object.keys(req.query).map(function(key) { return encodeURIComponent(key) + "=" + encodeURIComponent(req.query[key]); }).join("&"); }
2840
+
2841
+ // check for relaystate is set, test against configured server name and accepted query params
2842
+ if(req.body.RelayState !== undefined){
2843
+ var relayState = decodeURIComponent(req.body.RelayState);
2844
+ var serverName = (obj.getWebServerName(domain, req)).replaceAll('.','\\.');
2845
+
2846
+ var regexstr = `(?<=https:\\/\\/(?:.+?\\.)?${serverName}\\/?)` +
2847
+ `.*((?<=([\\?&])gotodevicename=(.{64})|` +
2848
+ `gotonode=(.{64})|` +
2849
+ `gotodeviceip=(((25[0-5]|(2[0-4]|1\\d|[1-9]|)\\d)\\.?\\b){4})|` +
2850
+ `gotodeviceip=(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|::([0-9a-fA-F]{1,4}:){1,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:)` +
2851
+ `lang=(.{5})|` +
2852
+ `sitestyle=(\\d+)|` +
2853
+ `user=(.{64})|` +
2854
+ `pass=(.{256})|` +
2855
+ `key=|` +
2856
+ `locale=|` +
2857
+ `gotomesh=(.{64})|` +
2858
+ `gotouser=(.{0,64})|` +
2859
+ `gotougrp=(.{64})|` +
2860
+ `debug=|` +
2861
+ `filter=|` +
2862
+ `webrtc=|` +
2863
+ `hide=|` +
2864
+ `viewmode=(\\d+)(?=[\\&]|\\b)))`;
2865
+
2866
+ var regex = new RegExp(regexstr);
2867
+ if(regex.test(relayState)){
2868
+ url = relayState;
2869
+ }
2870
+ }
2871
+
2872
res.end('<html><head><meta http-equiv="refresh" content=0;url="' + url + '"></head><body></body></html>');
2873
}
2874
@@ -6913,6 +6945,10 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
6945
obj.app.get(url + 'auth-saml', function (req, res, next) {
6946
var domain = getDomain(req);
6947
if (domain.passport == null) { next(); return; }
6948
+ //set RelayState when queries are passed
6949
+ if (Object.keys(req.query).length != 0){
6950
+ req.query.RelayState = encodeURIComponent(`${req.protocol}://${req.hostname}${req.originalUrl}`.replace('auth-saml/',''))
6951
+ }
6952
domain.passport.authenticate('saml-' + domain.id, { failureRedirect: domain.url, failureFlash: true })(req, res, next);
6953
});
6954
obj.app.post(url + 'auth-saml-callback', obj.bodyParser.urlencoded({ extended: false }), function (req, res, next) {