CotEditor Open Redirect (CWE-601) due to missing regex end anchor in cot_url_check()

Vulnerability Overview Title: regular expression lacks a trailing anchor, leading to subdomain spoofing open redirect (CWE-601) Issue: The function in is used to restrict redirects to the current site's domain. However, its regular expression lacks a trailing anchor ( ), allowing to pass validation. Attackers can exploit this vulnerability to redirect users to domains controlled by the attacker. Impact Scope Affected File: The function in (commit ) Affected Code: ```php return preg_match( '^' . preg_quote($sys['scheme'] . '://' . '{(' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domain'] . ')(?P' . $sys['domai

Goal Reached Thanks to every supporter — we hit 100%!

CotEditor Open Redirect (CWE-601) due to missing regex end anchor in cot_url_check()

More from this source