Skip to content
Snippets Groups Projects
  1. Oct 06, 2023
  2. Oct 05, 2023
  3. Oct 02, 2023
  4. Sep 28, 2023
    • Stefan Bürk's avatar
      [BUGFIX] Avoid redirect loop for empty redirect url · 158a2125
      Stefan Bürk authored
      Sending a redirect response with a empty `Location` is
      invalid per RFC. Browser vendor are dealing differntly
      with it.
      
      * Firefox executes a redirect to the current url, leading
        to an `endless` redirect chain - stopping it after some
        recursions with a coresponding notice in the network tab.
      * Chrome determines this and is doing nothing at all with
        it - leading to a white page.
      
      From the [1] RFC regarding invalid URI spec for `Location`:
      
      > Note: Some recipients attempt to recover from Location
      >       fields that are not valid URI references. This
      >       specification does not mandate or define such
      >       processing, but does allow it for the sake of
      >       robustness.
      
      A matching redirect record with a manually entered `/` as
      redirect target leads in TYPO3 v11 to this behaviour. This
      can be mitigated by selecting the corresponding site root.
      
      For TYPO3 v12 and upwards a change in the LinkHandling has
      been introduced which properly handles the `/` in the link
      generation and correctly returning a `/` as redirect url.
      That change has quite some impact and is not reasonable to
      be backported to TYPO3 v11 within #100958.
      
      This change adds an additionally guard to the `RedirectHandler`
      to handle empty redirect urls as endless loop, just logging
      it and not responding with an redirect. This helps in v11 and
      keeps a safety guard for the future in this place.
      
      [1] https://datatracker.ietf.org/doc/html/rfc7231#section-7.1.2
      
      Resolves: #100791
      Related: #100958
      Releases: main, 12.4, 11.5
      Change-Id: I2af2d5bf759a277ade45bd0f7740ffe0099003b3
      Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81280
      
      
      Tested-by: default avatarStefan Bürk <stefan@buerk.tech>
      Tested-by: default avatarcore-ci <typo3@b13.com>
      Reviewed-by: default avatarStefan Bürk <stefan@buerk.tech>
      158a2125
  5. Sep 27, 2023
  6. Sep 26, 2023
  7. Sep 25, 2023
  8. Sep 22, 2023
  9. Sep 21, 2023
  10. Sep 20, 2023
  11. Sep 18, 2023
  12. Sep 14, 2023
  13. Sep 12, 2023
  14. Sep 10, 2023
  15. Sep 09, 2023
  16. Sep 08, 2023
  17. Sep 07, 2023
  18. Sep 06, 2023
  19. Sep 05, 2023
  20. Sep 03, 2023
  21. Sep 01, 2023