Facebook OAuth hack by Nir Goldshlager (regex issue in next=YOUR_REDIRECT_URL)

[Antoine Galland]

Dear

Have you evaluate if the Spring Security OAuth 1.0.1 release is sensitive to this hack ?
http://www.nirgoldshlager.com/2013/0...-get-full.html
Cheers,
++ Antoine

[Dave Syer]

If you had a custom RedirectResolver you could probably expose yourself to the same attack. The DefaultRedirectResolver is not a regex matcher - take a look for yourself.