Validate prevUri redirect parameter

application/src/main/java/org/thingsboard/server/controller/AdminController.java

@@ -76,6 +76,7 @@ import org.thingsboard.server.dao.settings.SecuritySettingsService;
 import org.thingsboard.server.queue.util.TbCoreComponent;
 import org.thingsboard.server.service.security.auth.jwt.settings.JwtSettingsService;
 import org.thingsboard.server.service.security.auth.oauth2.CookieUtils;
+import org.thingsboard.server.service.security.auth.oauth2.PrevUriValidator;
 import org.thingsboard.server.service.security.model.SecurityUser;
 import org.thingsboard.server.service.security.model.token.JwtTokenFactory;
 import org.thingsboard.server.service.security.permission.Operation;
@@ -419,8 +420,9 @@ public class AdminController extends BaseController {
     @GetMapping(value = "/mail/oauth2/authorize", produces = "application/text")
     public String getAuthorizationUrl(HttpServletRequest request, HttpServletResponse response) throws ThingsboardException {
         String state = StringUtils.generateSafeToken();
-        if (request.getParameter(PREV_URI_PATH_PARAMETER) != null) {
-            CookieUtils.addCookie(response, PREV_URI_COOKIE_NAME, request.getParameter(PREV_URI_PATH_PARAMETER), 180);
+        String prevUriParam = request.getParameter(PREV_URI_PATH_PARAMETER);
+        if (PrevUriValidator.isValid(prevUriParam)) {
+            CookieUtils.addCookie(response, PREV_URI_COOKIE_NAME, prevUriParam, 180);
         }
         CookieUtils.addCookie(response, STATE_COOKIE_NAME, state, 180);
 
@@ -449,7 +451,7 @@ public class AdminController extends BaseController {
         Optional<Cookie> cookieState = CookieUtils.getCookie(request, STATE_COOKIE_NAME);
 
         String baseUrl = this.systemSecurityService.getBaseUrl(TenantId.SYS_TENANT_ID, new CustomerId(EntityId.NULL_UUID), request);
-        String prevUri = baseUrl + (prevUrlOpt.isPresent() ? prevUrlOpt.get().getValue() : "/settings/outgoing-mail");
+        String prevUri = baseUrl + prevUrlOpt.map(Cookie::getValue).filter(PrevUriValidator::isValid).orElse("/settings/outgoing-mail");
 
         if (cookieState.isEmpty() || !cookieState.get().getValue().equals(state)) {
             CookieUtils.deleteCookie(request, response, STATE_COOKIE_NAME);

application/src/main/java/org/thingsboard/server/service/security/auth/oauth2/HttpCookieOAuth2AuthorizationRequestRepository.java

@@ -43,8 +43,9 @@ public class HttpCookieOAuth2AuthorizationRequestRepository implements Authoriza
             CookieUtils.deleteCookie(request, response, OAUTH2_AUTHORIZATION_REQUEST_COOKIE_NAME);
             return;
         }
-        if (request.getParameter(PREV_URI_PARAMETER) != null) {
-            CookieUtils.addCookie(response, PREV_URI_COOKIE_NAME, request.getParameter(PREV_URI_PARAMETER), cookieExpireSeconds);
+        String prevUri = request.getParameter(PREV_URI_PARAMETER);
+        if (PrevUriValidator.isValid(prevUri)) {
+            CookieUtils.addCookie(response, PREV_URI_COOKIE_NAME, prevUri, cookieExpireSeconds);
         }
         CookieUtils.addCookie(response, OAUTH2_AUTHORIZATION_REQUEST_COOKIE_NAME, CookieUtils.serialize(authorizationRequest), cookieExpireSeconds);
     }

application/src/main/java/org/thingsboard/server/service/security/auth/oauth2/Oauth2AuthenticationSuccessHandler.java

@@ -83,17 +83,7 @@ public class Oauth2AuthenticationSuccessHandler extends SimpleUrlAuthenticationS
                                         Authentication authentication) throws IOException {
         OAuth2AuthorizationRequest authorizationRequest = httpCookieOAuth2AuthorizationRequestRepository.loadAuthorizationRequest(request);
         String callbackUrlScheme = authorizationRequest.getAttribute(TbOAuth2ParameterNames.CALLBACK_URL_SCHEME);
-        String baseUrl;
-        if (!StringUtils.isEmpty(callbackUrlScheme)) {
-            baseUrl = callbackUrlScheme + ":";
-        } else {
-            baseUrl = this.systemSecurityService.getBaseUrl(TenantId.SYS_TENANT_ID, new CustomerId(EntityId.NULL_UUID), request);
-            Optional<Cookie> prevUrlOpt = CookieUtils.getCookie(request, PREV_URI_COOKIE_NAME);
-            if (prevUrlOpt.isPresent()) {
-                baseUrl += prevUrlOpt.get().getValue();
-                CookieUtils.deleteCookie(request, response, PREV_URI_COOKIE_NAME);
-            }
-        }
+        String baseUrl = getBaseUrl(request, response, callbackUrlScheme);
         try {
             OAuth2AuthenticationToken token = (OAuth2AuthenticationToken) authentication;
 
@@ -125,6 +115,22 @@ public class Oauth2AuthenticationSuccessHandler extends SimpleUrlAuthenticationS
         }
     }
 
+    String getBaseUrl(HttpServletRequest request, HttpServletResponse response, String callbackUrlScheme) {
+        if (!StringUtils.isEmpty(callbackUrlScheme)) {
+            return callbackUrlScheme + ":";
+        }
+        String baseUrl = this.systemSecurityService.getBaseUrl(TenantId.SYS_TENANT_ID, new CustomerId(EntityId.NULL_UUID), request);
+        Optional<Cookie> prevUrlOpt = CookieUtils.getCookie(request, PREV_URI_COOKIE_NAME);
+        if (prevUrlOpt.isPresent()) {
+            String prevUri = prevUrlOpt.get().getValue();
+            if (PrevUriValidator.isValid(prevUri)) {
+                baseUrl += prevUri;
+            }
+            CookieUtils.deleteCookie(request, response, PREV_URI_COOKIE_NAME);
+        }
+        return baseUrl;
+    }
+
     protected void clearAuthenticationAttributes(HttpServletRequest request, HttpServletResponse response) {
         super.clearAuthenticationAttributes(request);
         httpCookieOAuth2AuthorizationRequestRepository.removeAuthorizationRequestCookies(request, response);
@@ -133,6 +139,8 @@ public class Oauth2AuthenticationSuccessHandler extends SimpleUrlAuthenticationS
     String getRedirectUrl(String baseUrl, JwtPair tokenPair) {
         if (baseUrl.indexOf("?") > 0) {
             baseUrl += "&";
+        } else if (baseUrl.endsWith("/")) {
+            baseUrl += "?";
         } else {
             baseUrl += "/?";
         }

application/src/main/java/org/thingsboard/server/service/security/auth/oauth2/PrevUriValidator.java

@@ -0,0 +1,47 @@
+/**
+ * Copyright © 2016-2026 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.service.security.auth.oauth2;
+
+import org.thingsboard.server.common.data.StringUtils;
+
+import java.util.Locale;
+
+public class PrevUriValidator {
+
+    private static final int MAX_LENGTH = 2048;
+
+    /**
+     * prevUri is appended to the platform base URL, which ends right after the authority, so the single leading '/'
+     * is what keeps the redirect on this host - it closes the authority before any of the value is read. The rest
+     * keeps an accepted value usable: it has to survive the cookie round trip (RFC 6265 allows neither control
+     * characters nor '"', ',', ';', '\' or non-ASCII) and to pass StrictHttpFirewall, which rejects '//', '%2f'
+     * and '%5c' in the path; a fragment would swallow the access token.
+     */
+    public static boolean isValid(String prevUri) {
+        if (StringUtils.isEmpty(prevUri) || prevUri.length() > MAX_LENGTH || prevUri.charAt(0) != '/') {
+            return false;
+        }
+        for (int i = 0; i < prevUri.length(); i++) {
+            char c = prevUri.charAt(i);
+            if (c <= ' ' || c >= 127 || c == '"' || c == ',' || c == ';' || c == '\\' || c == '#') {
+                return false;
+            }
+        }
+        String path = StringUtils.substringBefore(prevUri, "?").toLowerCase(Locale.ROOT);
+        return !path.contains("//") && !path.contains("%2f") && !path.contains("%5c");
+    }
+
+}

application/src/test/java/org/thingsboard/server/controller/AdminControllerTest.java

@@ -17,6 +17,7 @@ package org.thingsboard.server.controller;
 
 import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.node.ObjectNode;
+import jakarta.servlet.http.Cookie;
 import lombok.extern.slf4j.Slf4j;
 import org.apache.commons.lang3.RandomStringUtils;
 import org.junit.Test;
@@ -111,6 +112,28 @@ public class AdminControllerTest extends AbstractControllerTest {
                 .andExpect(statusReason(containsString("is prohibited")));
     }
 
+    @Test
+    public void testMailOAuth2AuthorizationStoresOnlyInAppPrevUri() throws Exception {
+        loginSysAdmin();
+        AdminSettings mailSettings = doGet("/api/admin/settings/mail", AdminSettings.class);
+        ObjectNode jsonValue = JacksonUtil.fromString(mailSettings.getJsonValue().toString(), ObjectNode.class);
+        jsonValue.put("clientId", "clientId");
+        jsonValue.put("authUri", "https://accounts.google.com/o/oauth2/v2/auth");
+        jsonValue.put("redirectUri", "https://thingsboard.io/api/admin/mail/oauth2/code");
+        jsonValue.set("scope", JacksonUtil.newArrayNode().add("https://mail.google.com/"));
+        mailSettings.setJsonValue(jsonValue);
+        doPost("/api/admin/settings", mailSettings, AdminSettings.class);
+
+        Cookie prevUriCookie = doGet("/api/admin/mail/oauth2/authorize?prevUri=@evil.com/")
+                .andExpect(status().isOk()).andReturn().getResponse().getCookie("prev_uri");
+        assertThat(prevUriCookie).isNull();
+
+        prevUriCookie = doGet("/api/admin/mail/oauth2/authorize?prevUri=/settings/outgoing-mail")
+                .andExpect(status().isOk()).andReturn().getResponse().getCookie("prev_uri");
+        assertThat(prevUriCookie).isNotNull();
+        assertThat(prevUriCookie.getValue()).isEqualTo("/settings/outgoing-mail");
+    }
+
     @Test
     public void testSendTestMail() throws Exception {
         Mockito.doNothing().when(mailService).sendTestMail(any(), anyString());

application/src/test/java/org/thingsboard/server/service/security/auth/oauth2/HttpCookieOAuth2AuthorizationRequestRepositoryTest.java

@@ -0,0 +1,66 @@
+/**
+ * Copyright © 2016-2026 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.service.security.auth.oauth2;
+
+import jakarta.servlet.http.Cookie;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import org.junit.jupiter.api.Test;
+import org.mockito.ArgumentCaptor;
+import org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationRequest;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.Mockito.atLeastOnce;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+import static org.thingsboard.server.service.security.auth.oauth2.HttpCookieOAuth2AuthorizationRequestRepository.PREV_URI_COOKIE_NAME;
+import static org.thingsboard.server.service.security.auth.oauth2.HttpCookieOAuth2AuthorizationRequestRepository.PREV_URI_PARAMETER;
+
+public class HttpCookieOAuth2AuthorizationRequestRepositoryTest {
+
+    private final HttpCookieOAuth2AuthorizationRequestRepository repository = new HttpCookieOAuth2AuthorizationRequestRepository();
+
+    @Test
+    public void testPrevUriSavedForInAppPath() {
+        assertThat(savePrevUri("/dashboards/3fa13530-6597-11ed-bd76-8bd591f0ec3e?state=someState"))
+                .isEqualTo("/dashboards/3fa13530-6597-11ed-bd76-8bd591f0ec3e?state=someState");
+    }
+
+    @Test
+    public void testPrevUriNotSavedForExternalUri() {
+        assertThat(savePrevUri("@evil.com/")).isNull();
+        assertThat(savePrevUri("https://evil.com")).isNull();
+        assertThat(savePrevUri("//evil.com")).isNull();
+    }
+
+    private String savePrevUri(String prevUri) {
+        HttpServletRequest request = mock(HttpServletRequest.class);
+        HttpServletResponse response = mock(HttpServletResponse.class);
+        when(request.getParameter(PREV_URI_PARAMETER)).thenReturn(prevUri);
+
+        repository.saveAuthorizationRequest(OAuth2AuthorizationRequest.authorizationCode()
+                .authorizationUri("testUri").clientId("testId").build(), request, response);
+
+        ArgumentCaptor<Cookie> cookieCaptor = ArgumentCaptor.forClass(Cookie.class);
+        verify(response, atLeastOnce()).addCookie(cookieCaptor.capture());
+        return cookieCaptor.getAllValues().stream()
+                .filter(cookie -> PREV_URI_COOKIE_NAME.equals(cookie.getName()))
+                .map(Cookie::getValue)
+                .findAny().orElse(null);
+    }
+
+}

application/src/test/java/org/thingsboard/server/service/security/auth/oauth2/Oauth2AuthenticationSuccessHandlerBaseUrlTest.java

@@ -0,0 +1,102 @@
+/**
+ * Copyright © 2016-2026 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.service.security.auth.oauth2;
+
+import jakarta.servlet.http.Cookie;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
+import org.mockito.ArgumentCaptor;
+import org.springframework.security.oauth2.client.OAuth2AuthorizedClientService;
+import org.thingsboard.server.common.data.id.CustomerId;
+import org.thingsboard.server.common.data.id.TenantId;
+import org.thingsboard.server.dao.oauth2.OAuth2ClientService;
+import org.thingsboard.server.service.security.model.token.JwtTokenFactory;
+import org.thingsboard.server.service.security.system.SystemSecurityService;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+import static org.thingsboard.server.service.security.auth.oauth2.HttpCookieOAuth2AuthorizationRequestRepository.PREV_URI_COOKIE_NAME;
+
+public class Oauth2AuthenticationSuccessHandlerBaseUrlTest {
+
+    private static final String BASE_URL = "https://thingsboard.example.com";
+
+    private final SystemSecurityService systemSecurityService = mock(SystemSecurityService.class);
+    private final Oauth2AuthenticationSuccessHandler successHandler = new Oauth2AuthenticationSuccessHandler(
+            mock(JwtTokenFactory.class), mock(OAuth2ClientMapperProvider.class), mock(OAuth2ClientService.class),
+            mock(OAuth2AuthorizedClientService.class), mock(HttpCookieOAuth2AuthorizationRequestRepository.class),
+            systemSecurityService);
+
+    private HttpServletRequest request;
+    private HttpServletResponse response;
+
+    @BeforeEach
+    public void before() {
+        request = mock(HttpServletRequest.class);
+        response = mock(HttpServletResponse.class);
+        when(systemSecurityService.getBaseUrl(any(TenantId.class), any(CustomerId.class), any(HttpServletRequest.class))).thenReturn(BASE_URL);
+    }
+
+    @Test
+    public void testInAppPathIsAppendedToBaseUrl() {
+        givenPrevUriCookie("/dashboards/3fa13530-6597-11ed-bd76-8bd591f0ec3e?state=someState");
+        assertThat(successHandler.getBaseUrl(request, response, null))
+                .isEqualTo(BASE_URL + "/dashboards/3fa13530-6597-11ed-bd76-8bd591f0ec3e?state=someState");
+    }
+
+    @ParameterizedTest
+    @ValueSource(strings = {"@evil.com/", "//evil.com", "https://evil.com", "/\\evil.com", "/dashboards#fragment"})
+    public void testForgedPrevUriCookieIsIgnored(String prevUri) {
+        givenPrevUriCookie(prevUri);
+        assertThat(successHandler.getBaseUrl(request, response, null)).isEqualTo(BASE_URL);
+    }
+
+    @Test
+    public void testForgedPrevUriCookieIsDeleted() {
+        givenPrevUriCookie("@evil.com/");
+
+        successHandler.getBaseUrl(request, response, null);
+
+        ArgumentCaptor<Cookie> cookieCaptor = ArgumentCaptor.forClass(Cookie.class);
+        verify(response).addCookie(cookieCaptor.capture());
+        assertThat(cookieCaptor.getValue().getName()).isEqualTo(PREV_URI_COOKIE_NAME);
+        assertThat(cookieCaptor.getValue().getMaxAge()).isZero();
+    }
+
+    @Test
+    public void testBaseUrlWithoutPrevUriCookie() {
+        when(request.getCookies()).thenReturn(null);
+        assertThat(successHandler.getBaseUrl(request, response, null)).isEqualTo(BASE_URL);
+    }
+
+    @Test
+    public void testCallbackUrlSchemeIgnoresPrevUri() {
+        givenPrevUriCookie("/dashboards/3fa13530-6597-11ed-bd76-8bd591f0ec3e");
+        assertThat(successHandler.getBaseUrl(request, response, "tbmobile")).isEqualTo("tbmobile:");
+    }
+
+    private void givenPrevUriCookie(String prevUri) {
+        when(request.getCookies()).thenReturn(new Cookie[]{new Cookie(PREV_URI_COOKIE_NAME, prevUri)});
+    }
+
+}

application/src/test/java/org/thingsboard/server/service/security/auth/oauth2/Oauth2AuthenticationSuccessHandlerTest.java

@@ -64,5 +64,10 @@ public class Oauth2AuthenticationSuccessHandlerTest extends AbstractControllerTe
         redirectUrl = oauth2AuthenticationSuccessHandler.getRedirectUrl(urlWithParams, jwtPair);
         expectedUrl = urlWithParams + "&accessToken=" + jwtPair.getToken() + "&refreshToken=" + jwtPair.getRefreshToken();
         assertEquals(expectedUrl, redirectUrl);
+
+        String urlWithTrailingSlash = "http://localhost:8080/";
+        redirectUrl = oauth2AuthenticationSuccessHandler.getRedirectUrl(urlWithTrailingSlash, jwtPair);
+        expectedUrl = urlWithTrailingSlash + "?accessToken=" + jwtPair.getToken() + "&refreshToken=" + jwtPair.getRefreshToken();
+        assertEquals(expectedUrl, redirectUrl);
     }
 }

application/src/test/java/org/thingsboard/server/service/security/auth/oauth2/PrevUriValidatorTest.java

@@ -0,0 +1,74 @@
+/**
+ * Copyright © 2016-2026 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.service.security.auth.oauth2;
+
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.NullAndEmptySource;
+import org.junit.jupiter.params.provider.ValueSource;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+public class PrevUriValidatorTest {
+
+    @ParameterizedTest
+    @ValueSource(strings = {
+            "/",
+            "/login",
+            "/dashboards/3fa13530-6597-11ed-bd76-8bd591f0ec3e",
+            "/dashboards/3fa13530-6597-11ed-bd76-8bd591f0ec3e?state=someState&page=1",
+            "/settings/outgoing-mail",
+            "/some%20path?q=a+b",
+            "/dashboards/3fa13530-6597-11ed-bd76-8bd591f0ec3e?state=W3siaWQiOiJhL2IifV0%3D"
+    })
+    public void testValidPrevUri(String prevUri) {
+        assertThat(PrevUriValidator.isValid(prevUri)).isTrue();
+    }
+
+    @ParameterizedTest
+    @NullAndEmptySource
+    @ValueSource(strings = {
+            "@evil.com/",
+            "evil.com",
+            "https://evil.com",
+            "//evil.com",
+            "/\\evil.com",
+            "/\tevil.com",
+            "/ evil.com",
+            "/dashboards\\..\\evil.com",
+            "/login\nLocation: https://evil.com",
+            "/login\r\nSet-Cookie: a=b",
+            "/dashboards//evil.com",
+            "/dashboards%2Fevil.com",
+            "/dashboards%5cevil.com",
+            "/dashboards;jsessionid=1",
+            "/dashboards?title=a,b",
+            "/dashboards,list",
+            "/dashboards\"list",
+            "/dashboards/3fa13530-6597-11ed-bd76-8bd591f0ec3e#fragment",
+            "/панель"
+    })
+    public void testInvalidPrevUri(String prevUri) {
+        assertThat(PrevUriValidator.isValid(prevUri)).isFalse();
+    }
+
+    @Test
+    public void testPrevUriLengthLimit() {
+        assertThat(PrevUriValidator.isValid("/" + "a".repeat(2047))).isTrue();
+        assertThat(PrevUriValidator.isValid("/" + "a".repeat(2048))).isFalse();
+    }
+
+}