diff --git a/internal/utils/app_utils.go b/internal/utils/app_utils.go index 28d815d..e36f4d8 100644 --- a/internal/utils/app_utils.go +++ b/internal/utils/app_utils.go @@ -2,6 +2,7 @@ package utils import ( "errors" + "fmt" "net" "net/url" "strings" @@ -95,7 +96,7 @@ func IsRedirectSafe(redirectURL string, domain string) bool { hostname := parsed.Hostname() - if strings.HasSuffix(hostname, domain) { + if strings.HasSuffix(hostname, fmt.Sprintf(".%s", domain)) { return true } diff --git a/internal/utils/app_utils_test.go b/internal/utils/app_utils_test.go index 08bb893..2af078e 100644 --- a/internal/utils/app_utils_test.go +++ b/internal/utils/app_utils_test.go @@ -205,4 +205,9 @@ func TestIsRedirectSafe(t *testing.T) { redirectURL = "http://example.org/page" result = utils.IsRedirectSafe(redirectURL, domain) assert.Equal(t, false, result) + + // Case with malicious domain + redirectURL = "https://malicious-example.com/yoyo" + result = utils.IsRedirectSafe(redirectURL, domain) + assert.Equal(t, false, result) }