Skip to content

fix: sanitize double-slashes in asset-worker redirects#10402

Merged
dario-piotrowicz merged 1 commit intocloudflare:mainfrom
danielrs:drivas/asset-worker-redirect-double-slash-vuln
Aug 19, 2025
Merged

fix: sanitize double-slashes in asset-worker redirects#10402
dario-piotrowicz merged 1 commit intocloudflare:mainfrom
danielrs:drivas/asset-worker-redirect-double-slash-vuln

Conversation

@danielrs
Copy link
Copy Markdown
Contributor

@danielrs danielrs commented Aug 18, 2025

A redirect rule such as:

/foo/* /:splat

And a request such as:

https://example.com/foo//google.com

Would result in a redirect target:

//google.com

Which would incorrectly resolve to:

https://google.com

When constructing a URL.

Problem was already patched in the live service.

Describe your change...


  • Tests
    • Tests included
    • Tests not necessary because:
  • Public documentation
    • Cloudflare docs PR(s):
    • Documentation not necessary because: bugfix
  • Wrangler V3 Backport
    • Wrangler PR:
    • Not necessary because: not a Wrangler change.

@danielrs danielrs requested review from a team as code owners August 18, 2025 18:17
@changeset-bot
Copy link
Copy Markdown

changeset-bot Bot commented Aug 18, 2025

🦋 Changeset detected

Latest commit: e271a93

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package
Name Type
@cloudflare/workers-shared Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@github-project-automation github-project-automation Bot moved this to Untriaged in workers-sdk Aug 18, 2025
@danielrs danielrs force-pushed the drivas/asset-worker-redirect-double-slash-vuln branch 2 times, most recently from 0460eda to f0d4edb Compare August 18, 2025 18:20
@pkg-pr-new
Copy link
Copy Markdown

pkg-pr-new Bot commented Aug 18, 2025

create-cloudflare

npm i https://pkg.pr.new/create-cloudflare@10402

@cloudflare/kv-asset-handler

npm i https://pkg.pr.new/@cloudflare/kv-asset-handler@10402

miniflare

npm i https://pkg.pr.new/miniflare@10402

@cloudflare/pages-shared

npm i https://pkg.pr.new/@cloudflare/pages-shared@10402

@cloudflare/unenv-preset

npm i https://pkg.pr.new/@cloudflare/unenv-preset@10402

@cloudflare/vite-plugin

npm i https://pkg.pr.new/@cloudflare/vite-plugin@10402

@cloudflare/vitest-pool-workers

npm i https://pkg.pr.new/@cloudflare/vitest-pool-workers@10402

@cloudflare/workers-editor-shared

npm i https://pkg.pr.new/@cloudflare/workers-editor-shared@10402

wrangler

npm i https://pkg.pr.new/wrangler@10402

commit: e271a93

@danielrs danielrs force-pushed the drivas/asset-worker-redirect-double-slash-vuln branch from f0d4edb to c8d6c8f Compare August 18, 2025 18:34
@github-project-automation github-project-automation Bot moved this from Untriaged to Approved in workers-sdk Aug 18, 2025
Copy link
Copy Markdown
Member

@dario-piotrowicz dario-piotrowicz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me 😄

Comment thread packages/workers-shared/asset-worker/src/utils/rules-engine.ts Outdated
A redirect rule such as:

```
/foo/* /:splat
```

And a request such as:

```
https://example.com/foo//google.com
```

Would result in a redirect target:

```
//google.com
```

Which would incorrectly resolve to:

```
https://google.com
```

When constructing a URL.
@danielrs danielrs force-pushed the drivas/asset-worker-redirect-double-slash-vuln branch from c8d6c8f to e271a93 Compare August 19, 2025 15:20
@dario-piotrowicz dario-piotrowicz merged commit 8fd6dc0 into cloudflare:main Aug 19, 2025
30 checks passed
@github-project-automation github-project-automation Bot moved this from Approved to Done in workers-sdk Aug 19, 2025
@workers-devprod workers-devprod added the contribution [Holopin] Recognizes an open-source contribution, big or small label Aug 19, 2025
@holopin-bot
Copy link
Copy Markdown

holopin-bot Bot commented Aug 19, 2025

Congratulations @danielrs, the maintainer of this repository has issued you a holobyte! Here it is: https://holopin.io/holobyte/cmeiq0cek068807kz3y1g1c9p

This badge can only be claimed by you, so make sure that your GitHub account is linked to your Holopin account. You can manage those preferences here: https://holopin.io/account.
Or if you're new to Holopin, you can simply sign up with GitHub, which will do the trick!

@danielrs danielrs deleted the drivas/asset-worker-redirect-double-slash-vuln branch August 19, 2025 16:53
@lrapoport-cf lrapoport-cf mentioned this pull request Aug 21, 2025
6 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

contribution [Holopin] Recognizes an open-source contribution, big or small

Projects

Archived in project

Development

Successfully merging this pull request may close these issues.

4 participants