closes #1956

Thomas Boutell · Thomas Boutell · commit 863f24ac9c29 · 2019-06-26T14:25:07.000-04:00
diff --git a/lib/modules/apostrophe-pages/lib/api.js b/lib/modules/apostrophe-pages/lib/api.js
@@ -961,6 +961,10 @@ module.exports = function(self, options) {
 
     req.slug = self.removeTrailingSlugSlashes(req, req.slug);
 
+    // Prevent open redirect attacks based on escaped paths
+    // (stomp double slashes)
+    req.slug = req.slug.replace(/\/+/g, '/');
+
     if ((!req.slug.length) || (req.slug.charAt(0) !== '/')) {
       req.slug = '/' + req.slug;
     }

Original file line number	Diff line number	Diff line change
`@@ -961,6 +961,10 @@ module.exports = function(self, options) {`
`961`	`961`
`962`	`962`	`req.slug = self.removeTrailingSlugSlashes(req, req.slug);`
`963`	`963`
	`964`	`+ // Prevent open redirect attacks based on escaped paths`
	`965`	`+ // (stomp double slashes)`
	`966`	`+ req.slug = req.slug.replace(/\/+/g, '/');`
	`967`	`+`
`964`	`968`	`if ((!req.slug.length) \|\| (req.slug.charAt(0) !== '/')) {`
`965`	`969`	`req.slug = '/' + req.slug;`
`966`	`970`	`}`