Skip to content
Snippets Groups Projects
Commit 158a2125 authored by Stefan Bürk's avatar Stefan Bürk
Browse files

[BUGFIX] Avoid redirect loop for empty redirect url

Sending a redirect response with a empty `Location` is
invalid per RFC. Browser vendor are dealing differntly
with it.

* Firefox executes a redirect to the current url, leading
  to an `endless` redirect chain - stopping it after some
  recursions with a coresponding notice in the network tab.
* Chrome determines this and is doing nothing at all with
  it - leading to a white page.

From the [1] RFC regarding invalid URI spec for `Location`:

> Note: Some recipients attempt to recover from Location
>       fields that are not valid URI references. This
>       specification does not mandate or define such
>       processing, but does allow it for the sake of
>       robustness.

A matching redirect record with a manually entered `/` as
redirect target leads in TYPO3 v11 to this behaviour. This
can be mitigated by selecting the corresponding site root.

For TYPO3 v12 and upwards a change in the LinkHandling has
been introduced which properly handles the `/` in the link
generation and correctly returning a `/` as redirect url.
That change has quite some impact and is not reasonable to
be backported to TYPO3 v11 within #100958.

This change adds an additionally guard to the `RedirectHandler`
to handle empty redirect urls as endless loop, just logging
it and not responding with an redirect. This helps in v11 and
keeps a safety guard for the future in this place.

[1] https://datatracker.ietf.org/doc/html/rfc7231#section-7.1.2

Resolves: #100791
Related: #100958
Releases: main, 12.4, 11.5
Change-Id: I2af2d5bf759a277ade45bd0f7740ffe0099003b3
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81280


Tested-by: default avatarStefan Bürk <stefan@buerk.tech>
Tested-by: default avatarcore-ci <typo3@b13.com>
Reviewed-by: default avatarStefan Bürk <stefan@buerk.tech>
parent 53230303
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment