QID 982401

_Has the problem been patched? What versions should users upgrade to?_
This is fixed in version 7.0.0 onwards.Workaround:
_Is there a way for users to fix or remediate the vulnerability without upgrading?_
Disable the whitelist domain feature and run separate OAuth2 Proxy instances for each subdomain.

# Original Issue Posted by @semoac:

Whitelist Domain feature is not working as expected because is not matching a dot to ensure the redirect is a subdomain.

## Expected Behavior

If whitelist domain is set to `.example.com` , then `hack.alienexample.com` should be rejected as a valid redirect.

## Current Behavior

The code is removing the `dot` from `.example.com` and only checking if the redirect string end with `example.com`

## Possible Solution
Here
https://github.com/oauth2-proxy/oauth2-proxy/blob/c377466411f2aee180a732187edb638f2f7e57fb/oauthproxy.go#L661

Include the dot when checking the string:
```
strings.HasSuffix(redirectHostname, "." + domainHostname)
```

## Steps to Reproduce (for bugs)

```
package main

import (
"fmt"
"strings"
)

func validOptionalPort(port string) bool {
if port == "" || port == ":*" {
return true
}
if port[0] != ':' {
return false
}
for _, b := range port[1:] {
if b < '0' || b > '9' {
return false
}
}
return true
}

func splitHostPort(hostport string) (host, port string) {
host = hostport

colon := strings.LastIndexByte(host, ':')
if colon != -1 && validOptionalPort(host[colon:]) {
host, port = host[:colon], host[colon+1:]
}

if strings.HasPrefix(host, "[") && strings.HasSuffix(host, "]") {
host = host[1 : len(host)-1]
}

return
}

func main() {
domain := ".example.com"
domainHostname, _ := splitHostPort(strings.TrimLeft(domain, "."))
redirectHostname := "https://hack.alienexample.com"
if (strings.HasPrefix(domain, ".") && strings.HasSuffix(redirectHostname, domainHostname)) { fmt.Println("This should not have happen.")}
}

```

Users of `github.com/oauth2-proxy/oauth2-proxy` are advised to update to `github.com/oauth2-proxy/oauth2-proxy/v7`