Fix/v4 open redirect CVE 2025 68470 v2 - #981
Open
KyleSudu1 wants to merge 3 commits into
Open
Conversation
…direct (CVE-2025-68470) This commit addresses a security vulnerability where paths with embedded double-slashes (e.g., "//evil.com") could be interpreted as protocol-relative URLs, leading to open redirect attacks. The fix adds validation in the createLocation() function to normalize any embedded double-slashes in the pathname by replacing consecutive slashes with a single slash (e.g., "//evil.com" becomes "/evil.com"). This change: - Prevents open redirect vulnerability (CWE-601) - Maintains backward compatibility with existing functionality - Adds a development warning when normalization occurs - Passes all 122 existing tests without modification The vulnerability affects all react-router v5.x versions that depend on history@4.x, impacting approximately ~101 PagerDuty repositories and the broader React Router v5 ecosystem. Testing: - All 122 existing tests pass - Runtime behavior properly normalizes double-slash paths - Development warnings guide developers to correct usage References: - CVE-2025-68470 - SNYK-JS-REACTROUTER-14908286 - CWE-601: URL Redirection to Untrusted Site (Open Redirect)
… fix Adds 10 new test cases to verify the CVE-2025-68470 security fix: String-based paths: - Double slashes at the start (//evil.com/path) - Double slashes in the middle (/the//path) - Multiple consecutive slashes (///path////segment) - Preservation of search and hash parameters - Protocol-relative URLs that could redirect externally Object-based paths: - Double slashes at the start with full location object - Double slashes in the middle with search and hash - Multiple consecutive slashes Regression tests: - Ensures normal paths are not modified - Verifies single slashes remain unchanged All tests validate that pathnames with embedded double-slashes are normalized to single slashes, preventing open redirect attacks while maintaining backward compatibility. Test results: 132/132 tests passing (10 new tests added)
> Co-authored-by: Eric Boshart <ericjboshart@protonmail.com> > Co-authored-by: Kevin Polson <kpolson@pagerduty.com>
Author
|
Tagging @mjackson because I saw you were the most recent approver of a pull request. Thank you for your time 🙏🏿 ! |
ebsmoove
pushed a commit
to ebsmoove/history
that referenced
this pull request
Jan 15, 2026
Comment out the security fix to show failing tests that demonstrate the open redirect vulnerability via double-slash pathnames. The fix is available in PR remix-run#981: remix-run#981 References: - CVE-2025-68470 - GHSA-9jcx-v3wj-wh4m Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR fixes a high-severity open redirect vulnerability (CVE-2025-68470) in the
history@4.xpackage that affects all React Router v5 applications.This work was co-authored by my coworkers Kevin Polson and Eric Boshart
Vulnerability Details
The Problem
The
createLocation()function inmodules/LocationUtils.jsdoes not validate paths with embedded double-slashes. This allows attackers to craft malicious URLs that redirect users to external sites:Solution
This PR adds pathname normalization in createLocation() to collapse embedded double-slashes into single slashes:
Key Changes:
Testing
Test Coverage: 132/132 tests passing
References