handlers: reject protocol-relative URLs in redirect validation

[adilburaksen]

Summary

check_redirect_url in src/appengine/handlers/base_handler.py uses
_SAFE_URL_PATTERN (based on the Closure Library SafeUrl pattern) to
validate redirect targets. The relative-URL branch of that pattern is:

[^:/?#]*(?:[/?#]|$)

[^:/?#]* can match zero characters, after which (?:[/?#]|$) matches
the leading / of //evil.com. This means the pattern accepts any
protocol-relative URL such as //attacker.example.com/steal as safe.

Browsers interpret //evil.com/path as scheme-relative (same scheme as
the current page), so a next=//evil.com/login parameter causes a
post-login redirect to the attacker's host.

Fix

Add a negative lookahead (?!//) to the relative-URL branch:

# Before
r'^(?:(?:https?|mailto|ftp):|[^:/?#]*(?:[/?#]|$))'

# After
r'^(?:(?:https?|mailto|ftp):|(?!//)[^:/?#]*(?:[/?#]|$))'

This rejects any URL that the relative branch would match but that begins
with //, while continuing to accept ordinary relative paths (/login,
relative/path) and absolute URLs with safe schemes.

Verification

>>> import re
>>> p = re.compile(r'^(?:(?:https?|mailto|ftp):|(?!//)[^:/?#]*(?:[/?#]|$))', re.I)
>>> bool(p.match('//evil.com/path'))
False
>>> bool(p.match('/login'))
True
>>> bool(p.match('https://clusterfuzz.com/'))
True