Allow for a validation regex for the next_link query parameter

[anoadragon453]

Allows setting a regex to validate the next_link query parameter on creating and validating 3pid validation sessions.

CI is expected to fail :/

[richvdh]

looks good, though I'm slightly concerned that a regex is a bit hard to use securely. For example, you need to check the link is https? rather than javascript or data; and http://server\.com.* is insecure, because it matches http://server.com.phishing.site/pwnmydataplease. https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.md#validating-urls specifically advises against using a regex due to this sort of footgun.

would a whitelist of domains serve the same purpose but be harder to mess up?

[anoadragon453]

would a whitelist of domains serve the same purpose but be harder to mess up?

This sounds good, thanks for looking into how easy it is to mess this up.

So a whitelist of domains looking something like:

• example.org
• bla.company.com

And then building a regex that looks like https?://$domain/.*?

[richvdh]

And then building a regex that looks like https?://$domain/.*?

why build a regex? Follow the advice at https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.md#validating-urls:

• parse the link using parse_url or whatever it's called
• check the scheme is http / https
• check if the domain matches any of the entries in the whitelist

Obligatory jwz quote:

Some people, when confronted with a problem, think “I know, I'll use regular expressions.” Now they have two problems.

[richvdh]

otherwise seems sane I think.