cas-authentication-user's redirect fix falls back to a request path Node parses as //bad.example.com

The redirect at line 708 of `index.js` reads `res.redirect(req.session.cas_return_to || requestPath(req))`; the one at line 318 redirects to the session value alone ^[11]. When the session value is empty the fallback supplies the target, and Node's `url.parse` reports the path `/\bad.example.com` with a pathname of `//bad.example.com` ^[10]. A Location beginning with two slashes is protocol-relative, so the browser reads what follows as a hostname and the victim lands on bad.example.com ^[5]. The guard runs upstream of that fallback.

Two assignments fill `cas_return_to`, at lines 315 and 453, and 0.3.0 validates the query-string value that arrives at each of them ^[12]. The request path arrives at both assignments as well, and line 708 falls back to that path on its own ^[13]. Five paths end at a `res.redirect` call, and `isSafeReturnTo` covers two of them ^[20].

The check itself is careful work. It requires a leading slash and refuses a second slash or a backslash in position two, so it was written by someone who knew that `//host` is protocol-relative and that `/\host` is the variant browsers normalise into the same thing ^[7]. It returns false for `//bad.example.com`, false for `/\bad.example.com`, and true for `/safe` ^[8]. The modelling error is one level up. "Auditing the input tells you that one road into the variable is guarded; auditing the sink tells you how many roads there are," the maintainer wrote ^[14]. He went looking for user input, found `returnTo` because a query parameter is what user input looks like, and never classified the request path as input at all, though a stranger chooses it completely by choosing what follows the hostname in the link ^[15].

The published reproduction calls `bounce_redirect` on a hand-built `req` object ^[21]. It does not show whether a given deployment delivers the backslash to `url.parse` untouched. Counting the assignments and fallbacks that reach `res.redirect` in the code a site actually runs was the check 0.3.0 needed before shipping ^[20].

A regression would have been the neater story, and the maintainer expected one: 0.3.0 had rewritten the URL handling to support mounted routers, and he assumed while writing the fix that the request-path redirect was his own ^[16]. On the fork's first commit, `url.parse(req.url).path` goes into `cas_return_to` and the code redirects to it after validating the ticket, with `cas_return_to` reproducing as `//bad.example.com` ^[17]. The two holes existed side by side for seven years and were fixed eight days apart ^[18]. By his account the inherited line was not a lapse by kayleecodes1, whose library he forked, because `url.parse` was the URL API in Node when that code was written ^[19].