{"action":"created","issue":{"url":"https://api.github.com/repos/go-macaron/macaron/issues/125","repository_url":"https://api.github.com/repos/go-macaron/macaron","labels_url":"https://api.github.com/repos/go-macaron/macaron/issues/125/labels{/name}","comments_url":"https://api.github.com/repos/go-macaron/macaron/issues/125/comments","events_url":"https://api.github.com/repos/go-macaron/macaron/issues/125/events","html_url":"https://github.com/go-macaron/macaron/issues/125","id":211626518,"number":125,"title":"url重定向漏洞","user":{"login":"netxfly","id":2337019,"avatar_url":"https://avatars2.githubusercontent.com/u/2337019?v=3","gravatar_id":"","url":"https://api.github.com/users/netxfly","html_url":"https://github.com/netxfly","followers_url":"https://api.github.com/users/netxfly/followers","following_url":"https://api.github.com/users/netxfly/following{/other_user}","gists_url":"https://api.github.com/users/netxfly/gists{/gist_id}","starred_url":"https://api.github.com/users/netxfly/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/netxfly/subscriptions","organizations_url":"https://api.github.com/users/netxfly/orgs","repos_url":"https://api.github.com/users/netxfly/repos","events_url":"https://api.github.com/users/netxfly/events{/privacy}","received_events_url":"https://api.github.com/users/netxfly/received_events","type":"User","site_admin":false},"labels":[{"id":192272702,"url":"https://api.github.com/repos/go-macaron/macaron/labels/feedback%20needed","name":"feedback needed","color":"fbca04","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2017-03-03T08:38:07Z","updated_at":"2017-03-06T08:52:00Z","closed_at":null,"body":"测试代码：\r\n```\r\npackage main\r\n\r\nimport (\r\n\t\"gopkg.in/macaron.v1\"\r\n)\r\n\r\nfunc main() {\r\n\tm := macaron.Classic()\r\n\tm.Use(macaron.Renderer())\r\n\r\n\tm.Get(\"/\", LoginIndex)\r\n\tm.Run()\r\n}\r\n\r\nfunc LoginIndex(ctx *macaron.Context) {\r\n\tctx.Write([]byte(\"fdasfas\"))\r\n\r\n}\r\n```\r\n\r\n构造以下的请求会跳转到指向的URL，可以用来做钓鱼攻击（FireFox和Safari上有效，chrome没成功）。\r\n`curl -v http://127.0.0.1:4000//www.baidu.com/%2e%2e`\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/go-macaron/macaron/issues/comments/284336445","html_url":"https://github.com/go-macaron/macaron/issues/125#issuecomment-284336445","issue_url":"https://api.github.com/repos/go-macaron/macaron/issues/125","id":284336445,"user":{"login":"netxfly","id":2337019,"avatar_url":"https://avatars2.githubusercontent.com/u/2337019?v=3","gravatar_id":"","url":"https://api.github.com/users/netxfly","html_url":"https://github.com/netxfly","followers_url":"https://api.github.com/users/netxfly/followers","following_url":"https://api.github.com/users/netxfly/following{/other_user}","gists_url":"https://api.github.com/users/netxfly/gists{/gist_id}","starred_url":"https://api.github.com/users/netxfly/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/netxfly/subscriptions","organizations_url":"https://api.github.com/users/netxfly/orgs","repos_url":"https://api.github.com/users/netxfly/repos","events_url":"https://api.github.com/users/netxfly/events{/privacy}","received_events_url":"https://api.github.com/users/netxfly/received_events","type":"User","site_admin":false},"created_at":"2017-03-06T08:52:00Z","updated_at":"2017-03-06T08:52:00Z","body":"现在是这样的，还没到用户自定义的路由里面，提交上面的请求后，框架层面就帮重定向了，用户还没机会去过滤URL重定向。\r\n\r\n"}}
{"actor":{"display_login":"netxfly"}}