[mirotalksfu] - fix open redirect

miroslavpejic85 · Feb 10, 2025 · 50e6dfa · 50e6dfa
1 parent b01d874
commit 50e6dfa
Show file tree

Hide file tree

Showing 5 changed files with 29 additions and 14 deletions.
diff --git a/app/src/Server.js b/app/src/Server.js
@@ -58,7 +58,7 @@ dev dependencies: {
  * @license For commercial or closed source, contact us at [email protected] or purchase directly via CodeCanyon
  * @license CodeCanyon: https://codecanyon.net/item/mirotalk-sfu-webrtc-realtime-video-conferences/40769970
  * @author  Miroslav Pejic - [email protected]
- * @version 1.7.25
+ * @version 1.7.26
  *
  */
 
@@ -416,12 +416,22 @@ function startServer() {
             });
             return res.status(400).send({ status: 404, message: err.message }); // Bad request
         }
-        if (req.path.substr(-1) === '/' && req.path.length > 1) {
-            let query = req.url.slice(req.path.length);
-            res.redirect(301, req.path.slice(0, -1) + query);
-        } else {
-            next();
+
+        // Remove multiple leading slashes & normalize path
+        let cleanPath = req.path.replace(/^\/+/, ''); // Removes all leading slashes
+        let query = req.url.slice(req.path.length);
+
+        // Prevent open redirect attacks by checking if the path is an external domain
+        if (/^([a-zA-Z0-9-]+\.)+[a-zA-Z]{2,}/.test(cleanPath)) {
+            return res.status(400).send('Bad Request: Potential Open Redirect Detected');
         }
+
+        // If a trailing slash exists, redirect to a clean version
+        if (req.path.endsWith('/') && req.path.length > 1) {
+            return res.redirect(301, '/' + cleanPath + query);
+        }
+
+        next();
     });
 
     // OpenID Connect - Dynamically set baseURL based on incoming host and protocol

diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
     "name": "mirotalksfu",
-    "version": "1.7.25",
+    "version": "1.7.26",
     "description": "WebRTC SFU browser-based video calls",
     "main": "Server.js",
     "scripts": {
@@ -58,7 +58,7 @@
     },
     "dependencies": {
         "@mattermost/client": "10.2.0",
-        "@sentry/node": "^8.54.0",
+        "@sentry/node": "^9.0.0",
         "axios": "^1.7.9",
         "colors": "1.4.0",
         "compression": "1.7.5",
@@ -90,7 +90,7 @@
         "mocha": "^11.1.0",
         "node-fetch": "^3.3.2",
         "nodemon": "^3.1.9",
-        "prettier": "3.4.2",
+        "prettier": "3.5.0",
         "proxyquire": "^2.1.3",
         "should": "^13.2.3",
         "sinon": "^19.0.2"

diff --git a/public/js/Brand.js b/public/js/Brand.js
@@ -64,7 +64,7 @@ let BRAND = {
     },
     about: {
         imageUrl: '../images/mirotalk-logo.gif',
-        title: '<strong>WebRTC SFU v1.7.25</strong>',
+        title: '<strong>WebRTC SFU v1.7.26</strong>',
         html: `
             <button 
                 id="support-button" 

diff --git a/public/js/Room.js b/public/js/Room.js
@@ -11,7 +11,7 @@ if (location.href.substr(0, 5) !== 'https') location.href = 'https' + location.h
  * @license For commercial or closed source, contact us at [email protected] or purchase directly via CodeCanyon
  * @license CodeCanyon: https://codecanyon.net/item/mirotalk-sfu-webrtc-realtime-video-conferences/40769970
  * @author  Miroslav Pejic - [email protected]
- * @version 1.7.25
+ * @version 1.7.26
  *
  */
 
@@ -4905,7 +4905,7 @@ function showAbout() {
         position: 'center',
         imageUrl: BRAND.about?.imageUrl && BRAND.about.imageUrl.trim() !== '' ? BRAND.about.imageUrl : image.about,
         customClass: { image: 'img-about' },
-        title: BRAND.about?.title && BRAND.about.title.trim() !== '' ? BRAND.about.title : 'WebRTC SFU v1.7.25',
+        title: BRAND.about?.title && BRAND.about.title.trim() !== '' ? BRAND.about.title : 'WebRTC SFU v1.7.26',
         html: `
             <br />
             <div id="about">

diff --git a/public/js/RoomClient.js b/public/js/RoomClient.js
@@ -9,7 +9,7 @@
  * @license For commercial or closed source, contact us at [email protected] or purchase directly via CodeCanyon
  * @license CodeCanyon: https://codecanyon.net/item/mirotalk-sfu-webrtc-realtime-video-conferences/40769970
  * @author  Miroslav Pejic - [email protected]
- * @version 1.7.25
+ * @version 1.7.26
  *
  */
 
@@ -8967,7 +8967,12 @@ class RoomClient {
         } catch (error) {
             switch (error.code) {
                 case 'quota_not_enough':
-                    this.msgPopup('warning', 'You’ve reached your quota limit for this demo account. Please consider upgrading for more features.', 6000, 'top');
+                    this.msgPopup(
+                        'warning',
+                        'You’ve reached your quota limit for this demo account. Please consider upgrading for more features.',
+                        6000,
+                        'top',
+                    );
                     break;
                 // ...
                 default: