diff --git a/docs/docs/CHANGELOG.md b/docs/docs/CHANGELOG.md index 115159d..013e228 100644 --- a/docs/docs/CHANGELOG.md +++ b/docs/docs/CHANGELOG.md @@ -23,6 +23,8 @@ This could allow an attacker to craft an Anubis pass-challenge URL that forces a This has been fixed by disallowing any URLs without the scheme `http` or `https`. +Additionally, the "Try again" button has been fixed to completely ignore the user-supplied redirect location. It now redirects to the home page (`/`). + ## v1.21.1: Minfilia Warde - Echo 1 - Expired records are now properly removed from bbolt databases ([#848](https://github.com/TecharoHQ/anubis/pull/848)). diff --git a/lib/anubis.go b/lib/anubis.go index dec822f..123b517 100644 --- a/lib/anubis.go +++ b/lib/anubis.go @@ -264,7 +264,7 @@ func (s *Server) checkRules(w http.ResponseWriter, r *http.Request, cr policy.Ch hash := rule.Hash() lg.Debug("rule hash", "hash", hash) - s.respondWithStatus(w, r, fmt.Sprintf("%s %s", localizer.T("access_denied"), hash), "/", s.policy.StatusCodes.Deny) + s.respondWithStatus(w, r, fmt.Sprintf("%s %s", localizer.T("access_denied"), hash), s.policy.StatusCodes.Deny) return true case config.RuleChallenge: lg.Debug("challenge requested") @@ -302,7 +302,7 @@ func (s *Server) handleDNSBL(w http.ResponseWriter, r *http.Request, ip string, localizer.T("dronebl_entry"), resp.String(), localizer.T("see_dronebl_lookup"), - ip), "/", s.policy.StatusCodes.Deny) + ip), s.policy.StatusCodes.Deny) return true } } @@ -388,7 +388,7 @@ func (s *Server) PassChallenge(w http.ResponseWriter, r *http.Request) { redirURL, err := url.ParseRequestURI(redir) if err != nil { lg.Error("invalid redirect", "err", err) - s.respondWithStatus(w, r, localizer.T("invalid_redirect"), "/", http.StatusBadRequest) + s.respondWithStatus(w, r, localizer.T("invalid_redirect"), http.StatusBadRequest) return } @@ -397,7 +397,7 @@ func (s *Server) PassChallenge(w http.ResponseWriter, r *http.Request) { // allowed default: lg.Error("XSS attempt blocked, invalid redirect scheme", "scheme", redirURL.Scheme) - s.respondWithStatus(w, r, localizer.T("invalid_redirect"), "/", http.StatusBadRequest) + s.respondWithStatus(w, r, localizer.T("invalid_redirect"), http.StatusBadRequest) return } @@ -466,7 +466,7 @@ func (s *Server) PassChallenge(w http.ResponseWriter, r *http.Request) { case errors.As(err, &cerr): switch { case errors.Is(err, challenge.ErrFailed): - s.respondWithStatus(w, r, cerr.PublicReason, "/", cerr.StatusCode) + s.respondWithStatus(w, r, cerr.PublicReason, cerr.StatusCode) case errors.Is(err, challenge.ErrInvalidFormat), errors.Is(err, challenge.ErrMissingField): s.respondWithError(w, r, cerr.PublicReason) } diff --git a/lib/http.go b/lib/http.go index 905724d..9ee0847 100644 --- a/lib/http.go +++ b/lib/http.go @@ -192,13 +192,13 @@ func (s *Server) RenderBench(w http.ResponseWriter, r *http.Request) { } func (s *Server) respondWithError(w http.ResponseWriter, r *http.Request, message string) { - s.respondWithStatus(w, r, message, "/", http.StatusInternalServerError) + s.respondWithStatus(w, r, message, http.StatusInternalServerError) } -func (s *Server) respondWithStatus(w http.ResponseWriter, r *http.Request, msg, redirect string, status int) { +func (s *Server) respondWithStatus(w http.ResponseWriter, r *http.Request, msg string, status int) { localizer := localization.GetLocalizer(r) - templ.Handler(web.Base(localizer.T("oh_noes"), web.ErrorPage(msg, s.opts.WebmasterEmail, redirect, localizer), s.policy.Impressum, localizer), templ.WithStatus(status)).ServeHTTP(w, r) + templ.Handler(web.Base(localizer.T("oh_noes"), web.ErrorPage(msg, s.opts.WebmasterEmail, localizer), s.policy.Impressum, localizer), templ.WithStatus(status)).ServeHTTP(w, r) } func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) { @@ -238,12 +238,12 @@ func (s *Server) ServeHTTPNext(w http.ResponseWriter, r *http.Request) { redir := r.FormValue("redir") urlParsed, err := r.URL.Parse(redir) if err != nil { - s.respondWithStatus(w, r, localizer.T("redirect_not_parseable"), "/", http.StatusBadRequest) + s.respondWithStatus(w, r, localizer.T("redirect_not_parseable"), http.StatusBadRequest) return } if (len(urlParsed.Host) > 0 && len(s.opts.RedirectDomains) != 0 && !slices.Contains(s.opts.RedirectDomains, urlParsed.Host)) || urlParsed.Host != r.URL.Host { - s.respondWithStatus(w, r, localizer.T("redirect_domain_not_allowed"), "/", http.StatusBadRequest) + s.respondWithStatus(w, r, localizer.T("redirect_domain_not_allowed"), http.StatusBadRequest) return } diff --git a/web/index.go b/web/index.go index ef58d4a..ee2042b 100644 --- a/web/index.go +++ b/web/index.go @@ -25,8 +25,8 @@ func Index(localizer *localization.SimpleLocalizer) templ.Component { return index(localizer) } -func ErrorPage(msg, mail, redirect string, localizer *localization.SimpleLocalizer) templ.Component { - return errorPage(msg, mail, redirect, localizer) +func ErrorPage(msg, mail string, localizer *localization.SimpleLocalizer) templ.Component { + return errorPage(msg, mail, localizer) } func Bench(localizer *localization.SimpleLocalizer) templ.Component { diff --git a/web/index.templ b/web/index.templ index 38eaa36..a018669 100644 --- a/web/index.templ +++ b/web/index.templ @@ -122,18 +122,10 @@ templ index(localizer *localization.SimpleLocalizer) { } -script reload(redirect string) { - if (redirect === "") { - redirect = "/"; - } - window.location = redirect; -} - -templ errorPage(message, mail, redirect string, localizer *localization.SimpleLocalizer) { +templ errorPage(message, mail string, localizer *localization.SimpleLocalizer) {
{ message }.
- if mail != "" {{ localizer.T("go_home") } { localizer.T("contact_webmaster") } diff --git a/web/index_templ.go b/web/index_templ.go index 7a3db05..1bb342f 100644 --- a/web/index_templ.go +++ b/web/index_templ.go @@ -440,20 +440,7 @@ func index(localizer *localization.SimpleLocalizer) templ.Component { }) } -func reload(redirect string) templ.ComponentScript { - return templ.ComponentScript{ - Name: `__templ_reload_f48f`, - Function: `function __templ_reload_f48f(redirect){if (redirect === "") { - redirect = "/"; - } - window.location = redirect; -}`, - Call: templ.SafeScript(`__templ_reload_f48f`, redirect), - CallInline: templ.SafeScriptInline(`__templ_reload_f48f`, redirect), - } -} - -func errorPage(message, mail, redirect string, localizer *localization.SimpleLocalizer) templ.Component { +func errorPage(message, mail string, localizer *localization.SimpleLocalizer) templ.Component { return templruntime.GeneratedTemplate(func(templ_7745c5c3_Input templruntime.GeneratedComponentInput) (templ_7745c5c3_Err error) { templ_7745c5c3_W, ctx := templ_7745c5c3_Input.Writer, templ_7745c5c3_Input.Context if templ_7745c5c3_CtxErr := ctx.Err(); templ_7745c5c3_CtxErr != nil { @@ -481,7 +468,7 @@ func errorPage(message, mail, redirect string, localizer *localization.SimpleLoc var templ_7745c5c3_Var28 string templ_7745c5c3_Var28, templ_7745c5c3_Err = templ.JoinStringErrs(anubis.BasePrefix + "/.within.website/x/cmd/anubis/static/img/reject.webp?cacheBuster=" + anubis.Version) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 134, Col: 181} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 127, Col: 181} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var28)) if templ_7745c5c3_Err != nil { @@ -494,7 +481,7 @@ func errorPage(message, mail, redirect string, localizer *localization.SimpleLoc var templ_7745c5c3_Var29 string templ_7745c5c3_Var29, templ_7745c5c3_Err = templ.JoinStringErrs(message) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 135, Col: 14} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 128, Col: 14} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var29)) if templ_7745c5c3_Err != nil { @@ -504,113 +491,83 @@ func errorPage(message, mail, redirect string, localizer *localization.SimpleLoc if templ_7745c5c3_Err != nil { return templ_7745c5c3_Err } - templ_7745c5c3_Err = templ.RenderScriptItems(ctx, templ_7745c5c3_Buffer, reload(redirect)) - if templ_7745c5c3_Err != nil { - return templ_7745c5c3_Err - } - templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 37, " ") - if templ_7745c5c3_Err != nil { - return templ_7745c5c3_Err - } if mail != "" { - templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 40, "
")
+ templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 37, " ")
if templ_7745c5c3_Err != nil {
return templ_7745c5c3_Err
}
- var templ_7745c5c3_Var32 string
- templ_7745c5c3_Var32, templ_7745c5c3_Err = templ.JoinStringErrs(localizer.T("go_home"))
+ var templ_7745c5c3_Var30 string
+ templ_7745c5c3_Var30, templ_7745c5c3_Err = templ.JoinStringErrs(localizer.T("go_home"))
if templ_7745c5c3_Err != nil {
- return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 139, Col: 40}
+ return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 131, Col: 40}
+ }
+ _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var30))
+ if templ_7745c5c3_Err != nil {
+ return templ_7745c5c3_Err
+ }
+ templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 38, " ")
+ if templ_7745c5c3_Err != nil {
+ return templ_7745c5c3_Err
+ }
+ var templ_7745c5c3_Var31 string
+ templ_7745c5c3_Var31, templ_7745c5c3_Err = templ.JoinStringErrs(localizer.T("contact_webmaster"))
+ if templ_7745c5c3_Err != nil {
+ return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 131, Col: 81}
+ }
+ _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var31))
+ if templ_7745c5c3_Err != nil {
+ return templ_7745c5c3_Err
+ }
+ templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 39, " ")
+ templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 40, "\">")
if templ_7745c5c3_Err != nil {
return templ_7745c5c3_Err
}
var templ_7745c5c3_Var33 string
- templ_7745c5c3_Var33, templ_7745c5c3_Err = templ.JoinStringErrs(localizer.T("contact_webmaster"))
+ templ_7745c5c3_Var33, templ_7745c5c3_Err = templ.JoinStringErrs(mail)
if templ_7745c5c3_Err != nil {
- return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 139, Col: 81}
+ return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 133, Col: 11}
}
_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var33))
if templ_7745c5c3_Err != nil {
return templ_7745c5c3_Err
}
- templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 42, "
") + templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 46, "\">
") if templ_7745c5c3_Err != nil { return templ_7745c5c3_Err } - var templ_7745c5c3_Var39 string - templ_7745c5c3_Var39, templ_7745c5c3_Err = templ.JoinStringErrs(localizer.T("static_check_endpoint")) + var templ_7745c5c3_Var37 string + templ_7745c5c3_Var37, templ_7745c5c3_Err = templ.JoinStringErrs(localizer.T("static_check_endpoint")) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 158, Col: 43} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 150, Col: 43} } - _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var39)) + _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var37)) if templ_7745c5c3_Err != nil { return templ_7745c5c3_Err } - templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 50, "
")
+ templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 48, "
")
+ templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 55, "\"> | ") if templ_7745c5c3_Err != nil { return templ_7745c5c3_Err } var templ_7745c5c3_Var46 string - templ_7745c5c3_Var46, templ_7745c5c3_Err = templ.JoinStringErrs(localizer.T("iters_b")) + templ_7745c5c3_Var46, templ_7745c5c3_Err = templ.JoinStringErrs(localizer.T("loading")) if templ_7745c5c3_Err != nil { - return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 176, Col: 52} + return templ.Error{Err: templ_7745c5c3_Err, FileName: `index.templ`, Line: 178, Col: 66} } _, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var46)) if templ_7745c5c3_Err != nil { return templ_7745c5c3_Err } - templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 57, " |
---|