Bug 1254226: XSS through javascript: callback URLs in auth delegation

r=dylan

1 files changed, 2 insertions, 0 deletions

diff --git a/auth.cgi b/auth.cgi
index b24957185..3f4590953 100755
--- a/auth.cgi
+++ b/auth.cgi
@@ -40,6 +40,8 @@ trick_taint($callback);
 trick_taint($description);
 
 my $callback_uri  = URI->new($callback);
+$callback_uri->scheme =~ /^https?$/
+  or ThrowUserError('auth_delegation_illegal_protocol', { protocol => $callback_uri->scheme });
 my $callback_base = $callback_uri->clone;
 $callback_base->query(undef);