[pboling]

Summary

• Block cross-origin redirects by default so OAuth credentials are not replayed and an attacker-controlled endpoint cannot provide a token response.
• Preserve an explicit :allow_cross_origin_redirects => true escape hatch for legacy integrations, while stripping per-request credentials and payloads.
• Add regression coverage and link the fix to GHSA-h4fh-g8xf-8255.

Validation

• K_SOUP_COV_MIN_HARD=false bundle exec kettle-test spec/oauth2/client_spec.rb (66 examples, 0 failures)
• bundle exec rubocop-gradual (no new issues)

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.

[github-actions]

Package	Line Rate	Branch Rate	Health
oauth2	97%	88%	➖
Summary	97% (416 / 429)	88% (72 / 82)	➖

Minimum allowed line rate is 92%

[coveralls]

Coverage Report for CI Build 40628591987

Coverage increased (+0.05%) to 95.499%

Details

• Coverage increased (+0.05%) from the base build.
• Patch coverage: 5 of 5 lines across 1 file are fully covered (100%).
• No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	429
Covered Lines:	416
Line Coverage:	96.97%
Relevant Branches:	82
Covered Branches:	72
Branch Coverage:	87.8%
Branches in Coverage %:	Yes
Coverage Strength:	34.17 hits per line

---

💛 - Coveralls