test

Author: evict

cmd/src/login_test.go

@@ -230,6 +230,46 @@ func TestValidateBrowserURL(t *testing.T) {
 	}
 }
 
+// TestValidateBrowserURL_WindowsRundll32Escape tests that validateBrowserURL blocks
+// payloads that could abuse the Windows "rundll32 url.dll,OpenURL" browser opener
+// (LOLBAS T1218.011). If any of these cases pass validation, an attacker-controlled
+// URL could execute arbitrary files via rundll32.
+// Reference: https://lolbas-project.github.io/lolbas/Libraries/Url/
+func TestValidateBrowserURL_WindowsRundll32Escape(t *testing.T) {
+	tests := []struct {
+		name string
+		url  string
+	}{
+		// url.dll OpenURL can launch .hta payloads via mshta.exe
+		{name: "hta via file protocol", url: "file:///C:/Temp/payload.hta"},
+		// url.dll OpenURL can launch executables from .url shortcut files
+		{name: "url shortcut file", url: "file:///C:/Temp/launcher.url"},
+		// url.dll OpenURL / FileProtocolHandler can run executables directly
+		{name: "exe via file protocol", url: "file:///C:/Windows/System32/calc.exe"},
+		// Obfuscated file protocol handler variant
+		{name: "obfuscated file handler", url: "file:///C:/Temp/payload.exe"},
+		// UNC path via file scheme to remote payload
+		{name: "unc path file scheme", url: "file://attacker.com/share/payload.exe"},
+		// data: URI could be passed through to a handler
+		{name: "data uri", url: "data:text/html,<script>alert(1)</script>"},
+		// vbscript scheme
+		{name: "vbscript scheme", url: "vbscript:Execute(\"MsgBox(1)\")"},
+		// about scheme
+		{name: "about scheme", url: "about:blank"},
+		// ms-msdt protocol handler (Follina-style)
+		{name: "ms-msdt handler", url: "ms-msdt:/id PCWDiagnostic /skip force /param"},
+		// search-ms protocol handler
+		{name: "search-ms handler", url: "search-ms:query=calc&crumb=location:\\\\attacker.com\\share"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if err := validateBrowserURL(tt.url); err == nil {
+				t.Errorf("validateBrowserURL(%q) = nil; want error (payload must be blocked to prevent rundll32 url.dll,OpenURL abuse)", tt.url)
+			}
+		})
+	}
+}
+
 func restoreStoredOAuthLoader(t *testing.T, loader func(context.Context, string) (*oauth.Token, error)) {
 	t.Helper()