Make a relative redirect URI absolute when 'Authorization' header present (#6325)

markekraus · daxian-dbw · commit 06b0bb2eb2dc · 2018-03-09T08:28:20.000-08:00
diff --git a/src/Microsoft.PowerShell.Commands.Utility/commands/utility/WebCmdlet/Common/WebRequestPSCmdlet.Common.cs b/src/Microsoft.PowerShell.Commands.Utility/commands/utility/WebCmdlet/Common/WebRequestPSCmdlet.Common.cs
@@ -1257,7 +1257,7 @@ internal virtual HttpResponseMessage GetResponse(HttpClient client, HttpRequestM
 
                 // recreate the HttpClient with redirection enabled since the first call suppressed redirection
                 using (client = GetHttpClient(false))
-                using (HttpRequestMessage redirectRequest = GetRequest(response.Headers.Location, stripAuthorization:true))
+                using (HttpRequestMessage redirectRequest = GetRequest(new Uri(request.RequestUri, response.Headers.Location), stripAuthorization:true))
                 {
                     FillRequestStream(redirectRequest);
                     _cancelToken = new CancellationTokenSource();
diff --git a/test/powershell/Modules/Microsoft.PowerShell.Utility/WebCmdlets.Tests.ps1 b/test/powershell/Modules/Microsoft.PowerShell.Utility/WebCmdlets.Tests.ps1
@@ -363,6 +363,8 @@ $redirectTests = @(
 
     @{redirectType = 'TemporaryRedirect'; redirectedMethod = 'GET'}
     @{redirectType = 'RedirectKeepVerb'; redirectedMethod = 'GET'} # Synonym for TemporaryRedirect
+
+    @{redirectType = 'relative'; redirectedMethod = 'GET'}
 )
 
 $PendingCertificateTest = $false
diff --git a/test/tools/WebListener/Controllers/RedirectController.cs b/test/tools/WebListener/Controllers/RedirectController.cs
@@ -30,12 +30,19 @@ public IActionResult Index(int count)
                 url = $"{url}/Redirect/{nextHop}";
             }
 
-            if (Request.Query.TryGetValue("type", out StringValues type) && Enum.TryParse(type.FirstOrDefault(), out HttpStatusCode status))
+            var typeIsPresent = Request.Query.TryGetValue("type", out StringValues type);
+
+            if (typeIsPresent && Enum.TryParse(type.FirstOrDefault(), out HttpStatusCode status))
             {
                 Response.StatusCode = (int)status;
                 url = $"{url}?type={type.FirstOrDefault()}";
                 Response.Headers.Add("Location", url);
             }
+            else if (typeIsPresent && String.Equals(type.FirstOrDefault(), "relative", StringComparison.InvariantCultureIgnoreCase))
+            {
+                url = new Uri($"{url}?type={type.FirstOrDefault()}").PathAndQuery;
+                Response.Redirect(url, false);
+            }
             else
             {
                 Response.Redirect(url, false);
diff --git a/test/tools/WebListener/README.md b/test/tools/WebListener/README.md
@@ -489,6 +489,7 @@ Invoke-RestMethod -Uri $uri -Body $body -Method 'Put'
 
 Will `302` redirect to `/Get/`. If a number is supplied, redirect will occur that many times. Can be used to test maximum redirects.
 If the `type` query field is supplied the corresponding `System.Net.HttpStatusCode` will be returned instead of `302`.
+If `type` is `relative`, the redirect URI will be relative instead of absolute.
 
 ```powershell
 $uri = Get-WebListenerUrl -Test 'Redirect' -TestValue '2'

Original file line number	Diff line number	Diff line change
`@@ -1257,7 +1257,7 @@ internal virtual HttpResponseMessage GetResponse(HttpClient client, HttpRequestM`
`1257`	`1257`
`1258`	`1258`	`// recreate the HttpClient with redirection enabled since the first call suppressed redirection`
`1259`	`1259`	`using (client = GetHttpClient(false))`
`1260`		`- using (HttpRequestMessage redirectRequest = GetRequest(response.Headers.Location, stripAuthorization:true))`
	`1260`	`+ using (HttpRequestMessage redirectRequest = GetRequest(new Uri(request.RequestUri, response.Headers.Location), stripAuthorization:true))`
`1261`	`1261`	`{`
`1262`	`1262`	`FillRequestStream(redirectRequest);`
`1263`	`1263`	`_cancelToken = new CancellationTokenSource();`
Original file line number	Diff line number	Diff line change
`@@ -363,6 +363,8 @@ $redirectTests = @(`
`363`	`363`
`364`	`364`	`@{redirectType = 'TemporaryRedirect'; redirectedMethod = 'GET'}`
`365`	`365`	`@{redirectType = 'RedirectKeepVerb'; redirectedMethod = 'GET'} # Synonym for TemporaryRedirect`
	`366`	`+`
	`367`	`+ @{redirectType = 'relative'; redirectedMethod = 'GET'}`
`366`	`368`	`)`
`367`	`369`
`368`	`370`	`$PendingCertificateTest = $false`
Original file line number	Diff line number	Diff line change
`@@ -30,12 +30,19 @@ public IActionResult Index(int count)`
`30`	`30`	`url = $"{url}/Redirect/{nextHop}";`
`31`	`31`	`}`
`32`	`32`
`33`		`- if (Request.Query.TryGetValue("type", out StringValues type) && Enum.TryParse(type.FirstOrDefault(), out HttpStatusCode status))`
	`33`	`+ var typeIsPresent = Request.Query.TryGetValue("type", out StringValues type);`
	`34`	`+`
	`35`	`+ if (typeIsPresent && Enum.TryParse(type.FirstOrDefault(), out HttpStatusCode status))`
`34`	`36`	`{`
`35`	`37`	`Response.StatusCode = (int)status;`
`36`	`38`	`url = $"{url}?type={type.FirstOrDefault()}";`
`37`	`39`	`Response.Headers.Add("Location", url);`
`38`	`40`	`}`
	`41`	`+ else if (typeIsPresent && String.Equals(type.FirstOrDefault(), "relative", StringComparison.InvariantCultureIgnoreCase))`
	`42`	`+ {`
	`43`	`+ url = new Uri($"{url}?type={type.FirstOrDefault()}").PathAndQuery;`
	`44`	`+ Response.Redirect(url, false);`
	`45`	`+ }`
`39`	`46`	`else`
`40`	`47`	`{`
`41`	`48`	`Response.Redirect(url, false);`