Typos can result in no redirect protection

• Type: Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: 7.0.X, 7.1.X, Master
• Fix Version/s: 7.0.0 DXP FP68, 7.0.X, 7.1.10 DXP FP5, 7.1.10.1 SP1, 7.1.2 CE GA3, 7.1.X, Master
• Component/s: Application Security
• Labels:
  • WhiteHat
  • ee-ts
  • liferay-dxp-70-sp10
  • liferay-dxp-71-sp1
  • liferay-fixpack-de-68-7010
  • liferay-fixpack-dxp-5-7110
• Branch Version/s:
  7.1.x, 7.0.x
• Backported to Branch:
  Committed
• Fix Priority: 3
• Git Pull Request: https://github.com/brianchandotcom/liferay-portal/pull/65074

A typo when setting the value of the redirect.url.security.mode property can lead to a situation where there is no redirection protection at all.

1. Add the following to your portal-ext.properties

   redirect.url.security.mode=domainZ
   redirect.url.domains.allowed=localhost

2. Go to http://localhost:8080/c/portal/login?redirect=http://www.example.com
3. Sign in

Result
User is redirected to example.com
Expected Result
Since the security mode is invalid, the portal should fall back on using IP mode.