Dave Kempe 6dfee70964 oidc: reject post-login redirects that browsers read as off-site ...

The login `next` check allowed anything starting with a single `/`.
Browsers treat `\` as `/` and drop tabs and newlines in Location, so
`/\evil.com`, and `/%09/evil.com` once the query was decoded, both
redirected to another site straight after a successful login on the
real login page. `next` must now be visible ASCII with no backslash,
and must not start with an encoded slash or backslash. That also keeps
it safe to place in the rustguac_next cookie unescaped, where a `;`
could previously add cookie attributes. Checked both when the cookie is
set and when it is consumed.

2026-10-01 22:04:17 +10:00

..

vdi

fix(vdi): include entry name in container names to avoid collisions (#138)

2026-05-27 20:48:24 +10:00

api.rs

session: fence probe, jump host and Proxmox; pin SSH/VNC address

2026-10-01 22:01:34 +10:00

auth.rs

auth: read X-Forwarded-For right to left; key limiters on it

2026-10-01 21:28:44 +10:00

browser.rs

deps: RustCrypto family + rand 0.10 batch upgrade

2026-04-29 14:54:14 +10:00

config.rs

auth: read X-Forwarded-For right to left; key limiters on it

2026-10-01 21:28:44 +10:00

db.rs

map-group: friendly re-mapping, CLI audit log, hermetic tests

2026-09-18 14:35:20 +10:00

drive.rs

Initial public release

2026-02-06 14:38:53 +11:00

guacd.rs

sessions: owner-only first connection, optional read-only joins

2026-10-01 21:21:35 +10:00

import.rs

feat(rdp): configurable keyboard layout (#209)

2026-08-28 15:24:38 +10:00

lib.rs

Add fuzz testing infrastructure and fix UTF-8 boundary panic

2026-02-07 13:39:16 +11:00

main.rs

auth: read X-Forwarded-For right to left; key limiters on it

2026-10-01 21:28:44 +10:00

migrate.rs

feat(vault): add vault-migrate subcommand for the DR split

2026-07-29 16:14:22 +10:00

oidc.rs

oidc: reject post-login redirects that browsers read as off-site

2026-10-01 22:04:17 +10:00

protocol.rs

fix(websocket): align guacd->browser writes to instruction boundary

2026-05-06 15:57:26 +10:00

pve.rs

feat(spice): Proxmox VE console connection type (node auto-detect, split token, SSH tunneling)

2026-07-24 17:42:09 +10:00

recording.rs

fix(recording): never rotate in-progress recordings; stop when a delete frees no space

2026-08-11 11:32:26 +10:00

session.rs

session: fence probe, jump host and Proxmox; pin SSH/VNC address

2026-10-01 22:01:34 +10:00

tunnel.rs

deps: adopt russh 0.63.1 and uuid 1.25.0

2026-08-30 05:48:08 +10:00

vault.rs

feat(rdp): configurable keyboard layout (#209)

2026-08-28 15:24:38 +10:00

websocket.rs

sessions: owner-only first connection, optional read-only joins

2026-10-01 21:21:35 +10:00