Some security fixes for Giraffe:

- URL validation in redirectTo to prevent XSS
- CSRF validation helpers
- Prevent XXE on XML deserialization

Author: Thorium

src/Giraffe/Core.fs

@@ -2,6 +2,7 @@ namespace Giraffe
 
 [<AutoOpen>]
 module Core =
+    open System
     open System.Text
     open System.Threading.Tasks
     open System.Globalization
@@ -252,8 +253,32 @@ module Core =
     /// <returns>A Giraffe <see cref="HttpHandler"/> function which can be composed into a bigger web application.</returns>
     let redirectTo (permanent: bool) (location: string) : HttpHandler =
         fun (next: HttpFunc) (ctx: HttpContext) ->
-            ctx.Response.Redirect(location, permanent)
-            Task.FromResult(Some ctx)
+            // Validate redirect URL to prevent open redirect vulnerabilities
+            // Allow only relative URLs or URLs with the same host
+            let isValidRedirect (url: string) =
+                if String.IsNullOrWhiteSpace(url) then
+                    false
+                elif url.StartsWith("/") then
+                    true // Relative URL
+                elif url.StartsWith("~/") then
+                    true // App-relative URL
+                else
+                    match Uri.TryCreate(url, UriKind.Absolute) with
+                    | true, uri ->
+                        // Only allow redirects to the same host
+                        let requestHost = ctx.Request.Host
+                        uri.Host = requestHost.Host
+                    | false, _ -> false
+
+            if isValidRedirect location then
+                ctx.Response.Redirect(location, permanent)
+                Task.FromResult(Some ctx)
+            else
+                // Log suspicious redirect attempt
+                let logger = ctx.GetLogger("Giraffe.Core")
+                logger.LogWarning("Blocked potential open redirect to: {Location}", location)
+                ctx.Response.StatusCode <- 400
+                Task.FromResult(Some ctx)
 
     // ---------------------------
     // Model binding functions

src/Giraffe/Csrf.fs

@@ -0,0 +1,121 @@
+namespace Giraffe
+
+/// <summary>
+/// CSRF (Cross-Site Request Forgery) protection helpers for Giraffe.
+/// Provides anti-forgery token generation and validation.
+/// </summary>
+[<RequireQualifiedAccess>]
+module Csrf =
+    open System
+    open System.Security.Cryptography
+    open System.Text
+    open Microsoft.AspNetCore.Http
+    open Microsoft.Extensions.Logging
+    open Microsoft.AspNetCore.Antiforgery
+
+    /// <summary>
+    /// Default CSRF token header name
+    /// </summary>
+    [<Literal>]
+    let DefaultCsrfTokenHeaderName = "X-CSRF-TOKEN"
+
+    /// <summary>
+    /// Default CSRF token form field name
+    /// </summary>
+    [<Literal>]
+    let DefaultCsrfTokenFormFieldName = "__RequestVerificationToken"
+
+    /// <summary>
+    /// Validates the CSRF token from the request.
+    /// Checks for token in header (X-CSRF-TOKEN) or form field (__RequestVerificationToken).
+    /// </summary>
+    /// <param name="next">The next HttpFunc</param>
+    /// <param name="ctx">The HttpContext</param>
+    /// <returns>HttpFuncResult</returns>
+    let validateCsrfToken: HttpHandler =
+        fun (next: HttpFunc) (ctx: HttpContext) ->
+            task {
+                let antiforgery = ctx.GetService<IAntiforgery>()
+
+                try
+                    let! isValid = antiforgery.IsRequestValidAsync(ctx)
+
+                    if isValid then
+                        return! next ctx
+                    else
+                        let logger = ctx.GetLogger("Giraffe.Csrf")
+                        logger.LogWarning("CSRF token validation failed for request to {Path}", ctx.Request.Path)
+                        ctx.Response.StatusCode <- 403
+                        return Some ctx
+                with ex ->
+                    let logger = ctx.GetLogger("Giraffe.Csrf")
+                    logger.LogWarning(ex, "CSRF token validation error for request to {Path}", ctx.Request.Path)
+                    ctx.Response.StatusCode <- 403
+                    return Some ctx
+            }
+
+    /// <summary>
+    /// Alias for validateCsrfToken - validates anti-forgery tokens from requests.
+    /// </summary>
+    let requireAntiforgeryToken = validateCsrfToken
+
+    /// <summary>
+    /// Generates a CSRF token and adds it to the HttpContext items for use in views.
+    /// The token can be accessed via ctx.Items["CsrfToken"] and ctx.Items["CsrfTokenHeaderName"].
+    /// </summary>
+    /// <param name="next">The next HttpFunc</param>
+    /// <param name="ctx">The HttpContext</param>
+    /// <returns>HttpFuncResult</returns>
+    let generateCsrfToken: HttpHandler =
+        fun (next: HttpFunc) (ctx: HttpContext) ->
+            task {
+                let antiforgery = ctx.GetService<IAntiforgery>()
+                let tokens = antiforgery.GetAndStoreTokens(ctx)
+
+                // Store token for view rendering
+                ctx.Items.["CsrfToken"] <- tokens.RequestToken
+                ctx.Items.["CsrfTokenHeaderName"] <- tokens.HeaderName
+
+                return! next ctx
+            }
+
+    /// <summary>
+    /// Returns the CSRF token as JSON for AJAX requests.
+    /// Response format: { "token": "...", "headerName": "X-CSRF-TOKEN" }
+    /// </summary>
+    /// <param name="next">The next HttpFunc</param>
+    /// <param name="ctx">The HttpContext</param>
+    /// <returns>HttpFuncResult</returns>
+    let csrfTokenJson: HttpHandler =
+        fun (next: HttpFunc) (ctx: HttpContext) ->
+            task {
+                let antiforgery = ctx.GetService<IAntiforgery>()
+                let tokens = antiforgery.GetAndStoreTokens(ctx)
+
+                let response =
+                    {|
+                        token = tokens.RequestToken
+                        headerName = tokens.HeaderName
+                    |}
+
+                return! Core.json response next ctx
+            }
+
+    /// <summary>
+    /// Returns the CSRF token as an HTML hidden input field.
+    /// Can be included directly in forms.
+    /// </summary>
+    /// <param name="next">The next HttpFunc</param>
+    /// <param name="ctx">The HttpContext</param>
+    /// <returns>HttpFuncResult</returns>
+    let csrfTokenHtml: HttpHandler =
+        fun (next: HttpFunc) (ctx: HttpContext) ->
+            task {
+                let antiforgery = ctx.GetService<IAntiforgery>()
+                let tokens = antiforgery.GetAndStoreTokens(ctx)
+
+                let html =
+                    sprintf "<input type=\"hidden\" name=\"%s\" value=\"%s\" />" tokens.HeaderName tokens.RequestToken
+
+                return! Core.htmlString html next ctx
+            }

src/Giraffe/Giraffe.fsproj

@@ -82,6 +82,7 @@
     <Compile Include="ModelParser.fs" />
     <Compile Include="HttpContextExtensions.fs" />
     <Compile Include="Core.fs" />
+    <Compile Include="Csrf.fs" />
     <Compile Include="ResponseCaching.fs" />
     <Compile Include="ModelValidation.fs" />
     <Compile Include="Auth.fs" />

src/Giraffe/Xml.fs

@@ -44,5 +44,14 @@ module SystemXml =
 
             member __.Deserialize<'T>(xml: string) =
                 let serializer = XmlSerializer(typeof<'T>)
-                use reader = new StringReader(xml)
-                serializer.Deserialize reader :?> 'T
+                use stringReader = new StringReader(xml)
+                // Secure XML parsing: disable DTD processing and external entities to prevent XXE attacks
+                let xmlReaderSettings =
+                    new XmlReaderSettings(
+                        DtdProcessing = DtdProcessing.Prohibit,
+                        XmlResolver = null,
+                        MaxCharactersFromEntities = 1024L * 1024L
+                    ) // 1MB limit
+
+                use xmlReader = XmlReader.Create(stringReader, xmlReaderSettings)
+                serializer.Deserialize xmlReader :?> 'T