fix: only navigate to a validated absolute http(s) return URL [4.2] - #621
Open
oc-tmueller wants to merge 1 commit into
Open
fix: only navigate to a validated absolute http(s) return URL [4.2]#621oc-tmueller wants to merge 1 commit into
oc-tmueller wants to merge 1 commit into
Conversation
The return-to-server value is now supplied by the server side through a hidden input instead of being read from the URL. federated() validates it as an absolute http(s) URL with a non-empty host and rejects anything else the same way the other request guards do; index() and public() emit an empty value, since only a federated share ever returns to a remote server. documents.js re-checks the value before using it as a navigation target and falls back to the document list if it does not parse. A path is accepted, installations can live in a subdirectory. Also narrows the WOPI postMessage target origin from '*' to the Collabora Online origin derived from the discovery urlsrc, and ignores incoming messages that do not come from that origin. That origin has to fail closed, and new URL() throws for neither of the two ways it can be missing: an empty urlsrc - which is what discovery returns when it cannot be read - resolves against the base URL and would make this server its own Collabora Online origin, and a urlsrc that is not http(s) has the opaque origin 'null', which is also what a sandboxed frame reports as its own origin. Both now yield no origin at all, so messages are neither accepted nor sent. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com>
oc-tmueller
force-pushed
the
fix/validated-return-to-server-url-4.2
branch
from
September 9, 2026 10:41
42dba4e to
4f4173f
Compare
phil-davis
approved these changes
Sep 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #620 to the 4.2 (ownCloud 10) line.
The four touched files are byte-identical between
4.2andmaster, so this isa clean cherry-pick of the same commit — no adaptation was needed.
Summary
The value that tells the editor where to navigate when it is closed is now
supplied by the server side and validated, instead of being taken from the
serverURL parameter indocuments.js.DocumentController::federated()validatesserveras an absolute http(s)URL with a non-empty host and returns the usual
responseError()otherwise,alongside the existing request guards. The validated value is handed to the
template as
return_to_server.index()andpublic()emit an emptyreturn_to_server— only a federatedshare ever returns to a remote server. All three methods render the same
template, so all three set the key.
templates/documents.phpemits it as a hidden input, following the existing#wopi-urlidiom.documents.jsreads that hidden input rather than the URL parameter, andre-checks the value with
new URL()before using it as a navigation target,falling back to the document list if it does not parse. A path component is
accepted, so subdirectory installs keep working.
Separately, the WOPI
postMessagetarget origin is narrowed from'*'to theCollabora Online origin derived from the discovery
urlsrc, and bothmessagelisteners now ignore events that do not come from that origin.
Core's shared
getURLParameter()is deliberately untouched — it is a globalalso used by
apps/files.Testing
Re-verified on this branch against ownCloud 10.16.4 / PHP 7.4, not just
copied from #620:
DocumentControllerTest, 20 of them new).appinfo lib: no errors.The JS side is verified manually — this repo has no JS test harness.
🤖 Generated with Claude Code