Patch for CVE-2019-10721

[irbishop]

Based off:

https://docs.microsoft.com/en-us/aspnet/mvc/overview/security/preventing-open-redirection-attacks

[irbishop]

Whoops, good catch. I put in the wrong index. The last condition should have been [1].

…

On Sun, Apr 21, 2019, 02:26 David Jade ***@***.***> wrote: ***@***.**** commented on this pull request. ------------------------------ In BlogEngine/BlogEngine.Core/Services/Security/Security.cs <#205 (comment)>: > @@ -204,6 +201,18 @@ public static bool AuthenticateUser(string username, string password, bool remem return false; } + private static bool IsLocalUrl(string url) + { + if (string.IsNullOrEmpty(url)) + { + return false; + } + else + { + return ((url[0] == '/' && (url.Length == 1 || (url[1] != '/' && url[1] != '\\'))) || (url.Length > 1 && url[0] == '~' && url[0] == '/')); There seems to be a condition here that can never be true - this part: (url.Length > 1 && url[0] == '~' && url[0] == '/') — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#205 (review)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AABHJ7JOLJAG25ZMEYDGOILPRQQMTANCNFSM4HHKU53A> .

[irbishop]

Typo, will fix and resend