Skip to content

Commit 6e4468a

Browse files
authored
Bug fix: thirdparty site cookie leak
bug report https://www.huntr.dev/bounties/42c79c23-6646-46c4-871d-219c0d4b4e31/
1 parent 81eaf56 commit 6e4468a

File tree

1 file changed

+17
-0
lines changed

1 file changed

+17
-0
lines changed

index.js

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,9 @@ const once = require('once')
99
const querystring = require('querystring')
1010
const url = require('url')
1111

12+
var flag=false
13+
var original_host;
14+
1215
const isStream = o => o !== null && typeof o === 'object' && typeof o.pipe === 'function'
1316

1417
function simpleGet (opts, cb) {
@@ -34,6 +37,13 @@ function simpleGet (opts, cb) {
3437
opts.headers['content-type'] = 'application/x-www-form-urlencoded'
3538
}
3639

40+
//getting original host
41+
if (!flag){
42+
original_host=opts.hostname
43+
//console.log(original_host)
44+
flag=true
45+
}
46+
3747
if (body) {
3848
if (!opts.method) opts.method = 'POST'
3949
if (!isStream(body)) opts.headers['content-length'] = Buffer.byteLength(body)
@@ -51,6 +61,13 @@ function simpleGet (opts, cb) {
5161
delete opts.headers.host // Discard `host` header on redirect (see #32)
5262
res.resume() // Discard response
5363

64+
var redirect_host=url.parse(opts.url).hostname //getting redirected hostname
65+
//if redirected host is different than original host then drop cookie header to prevent cookie leak in thirdparty site redirect
66+
if(redirect_host !== null && redirect_host !== original_host){
67+
delete opts.headers.cookie;
68+
delete opts.headers.authorization;
69+
}
70+
5471
if (opts.method === 'POST' && [301, 302].includes(res.statusCode)) {
5572
opts.method = 'GET' // On 301/302 redirect, change POST to GET (see #35)
5673
delete opts.headers['content-length']; delete opts.headers['content-type']

0 commit comments

Comments
 (0)