Open Redirect in TYPO3 CMS

@@ -2551,7 +2551,7 @@ public static function copyDirectory(string $source, string $destination): void
 
     /**
      * Checks if a given string is a valid frame URL to be loaded in the
-     * backend.
+     * backend or used in redirect headers.
      *
      * If the given url is empty or considered to be harmless, it is returned
      * as is, else the event is logged and an empty string is returned.
@@ -2564,6 +2564,10 @@ public static function sanitizeLocalUrl(string $url): string
         $sanitizedUrl = '';
         if (!empty($url)) {
             $decodedUrl = rawurldecode($url);
+            if (strpbrk($decodedUrl, " \n\r\t\v\x00") !== false) {
+                static::getLogger()->notice('URL "{url}" contains unexpected whitespace and was denied as local url.', ['url' => $url]);
+                return '';
+            }
             $parsedUrl = parse_url($decodedUrl);
             // Pass if URL is on the current host:
             if (self::isValidUrl($decodedUrl)) {

@@ -1447,6 +1447,11 @@ public static function sanitizeLocalUrlInvalidDataProvider(): array
             'invalid URL, UNC path' => ['\\\\foo\\bar\\'],
             'invalid URL, HTML break out attempt' => ['" >blabuubb'],
             'base64 encoded string' => ['data:%20text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4='],
+            'relative URL with location header injection via leading space' => [' //evil.site/'],
+            'relative URL with location header injection via leading horizontal tab' => ["\t" . '//evil.site/'],
+            'relative URL with location header injection attempt (not known to work) via vertical white space' => ["\v" . '//evil.site/'],
+            'HTTP header smuggling attempt' => ["/\r\nX-Injected: evil"],
+            'null-byte break out attempt' => ["http\x00://www.google.de"],
         ];
     }