Fixes #36768: Prevent redirection to other hosts via HTTP referer header

[ehelms]

CVE-2022-4130: Blind SSRF via Referer header

For routes that use redirect_back_or_to the HTTP referer header can be set and cause a redirection to a different URL on a different machine. The presence of this option forces the fallback URL to be used.

https://api.rubyonrails.org/classes/ActionController/Redirecting.html#method-i-redirect_back_or_to

[theforeman-bot]

Issues: #36768

[evgeni]

Test failure related. I think the test needs adjustment:

foreman/test/controllers/users_controller_test.rb

Line 449 in d0fcacd

@previous_url = "/bookmarks"

@previous_url = "http://test.host/bookmarks"

As I think otherwise the checker fails in
https://github.com/rails/rails/blob/90b0266e9bfaaadbd2d249ad2eeec042077a0063/actionpack/lib/action_controller/metal/redirecting.rb#L135-L139
as the URL has no host

[evgeni]

Interestingly, in Rails 7, this does default to false :)

[evgeni]

can you please add this issue to https://github.com/theforeman/theforeman.org/blob/gh-pages/security.md?

[ehelms]

can you please add this issue to https://github.com/theforeman/theforeman.org/blob/gh-pages/security.md?

Opened -- theforeman/theforeman.org#2102