KNOX-3488: Harden original-url cookie validation

[hanicz]

KNOX-3488 - harden original-url cookie validation

What changes were proposed in this pull request?

• WebSSOResource validated the redirect target only when it came from the originalUrl query param — the original-urlcookie branch used the value verbatim, skipping the userinfo and whitelist checks. A request carrying a crafted cookie was redirected to any attacker host, bypassing the configured (and default) whitelist.

How was this patch tested?

Tested locally, new unit tests, homepage login

curl -iku guest:guest-password --cookie "original-url=https://draco.malfoy" 'https://localhost:8443/gateway/knoxsso/api/v1/websso'

HTTP/1.1 400 Bad Request

curl -iku guest:guest-password --cookie "original-url=https://localhost:8443@draco.malfoy" 'https://localhost:8443/gateway/knoxsso/api/v1/websso'

HTTP/1.1 400 Bad Request

curl -iku guest:guest-password --cookie "original-url=https://localhost:8443%252f@draco.malfoy" 'https://localhost:8443/gateway/knoxsso/api/v1/websso'

HTTP/1.1 400 Bad Request

curl -iku guest:guest-password 'https://localhost:8443/gateway/knoxsso/api/v1/websso?originalUrl=https://localhost:8443%252f@malicious.link/'

HTTP/1.1 400 Bad Request

[github-actions]

Test Results

  4 files    4 suites   44s ⏱️
127 tests 127 ✅ 0 💤 0 ❌
145 runs  145 ✅ 0 💤 0 ❌

Results for commit f84e0dd.

♻️ This comment has been updated with latest results.

[bonampak]

This looks ok, but logout.jsp should also be hardened.