+50
-2
lines changedFilter options
+50
-2
lines changed Original file line number Diff line number Diff line change
@@ -290,8 +290,12 @@ def is_safe_url(url, host=None):
290 290
url = url.strip()
291 291
if not url:
292 292
return False
293 -
# Chrome treats \ completely as /
294 -
url = url.replace('\\', '/')
293 +
# Chrome treats \ completely as / in paths but it could be part of some
294 +
# basic auth credentials so we need to check both URLs.
295 +
return _is_safe_url(url, host) and _is_safe_url(url.replace('\\', '/'), host)
296 + 297 + 298 +
def _is_safe_url(url, host):
295 299
# Chrome considers any URL with more than two slashes to be absolute, but
296 300
# urlparse is not so flexible. Treat any url with three slashes as unsafe.
297 301
if url.startswith('///'):
@@ -6,6 +6,22 @@ Django 1.8.10 release notes
6 6 7 7
Django 1.8.10 fixes two security issues and several bugs in 1.8.9.
8 8 9 +
CVE-2016-2512: Malicious redirect and possible XSS attack via user-supplied redirect URLs containing basic auth
10 +
===============================================================================================================
11 + 12 +
Django relies on user input in some cases (e.g.
13 +
:func:`django.contrib.auth.views.login` and :doc:`i18n </topics/i18n/index>`)
14 +
to redirect the user to an "on success" URL. The security check for these
15 +
redirects (namely ``django.utils.http.is_safe_url()``) considered some URLs
16 +
with basic authentication credentials "safe" when they shouldn't be.
17 + 18 +
For example, a URL like ``http://mysite.example.com\@attacker.com`` would be
19 +
considered safe if the request's host is ``http://mysite.example.com``, but
20 +
redirecting to this URL sends the user to ``attacker.com``.
21 + 22 +
Also, if a developer relies on ``is_safe_url()`` to provide safe redirect
23 +
targets and puts such a URL into a link, they could suffer from an XSS attack.
24 + 9 25
Bugfixes
10 26
========
11 27
@@ -6,6 +6,22 @@ Django 1.9.3 release notes
6 6 7 7
Django 1.9.3 fixes two security issues and several bugs in 1.9.2.
8 8 9 +
CVE-2016-2512: Malicious redirect and possible XSS attack via user-supplied redirect URLs containing basic auth
10 +
===============================================================================================================
11 + 12 +
Django relies on user input in some cases (e.g.
13 +
:func:`django.contrib.auth.views.login` and :doc:`i18n </topics/i18n/index>`)
14 +
to redirect the user to an "on success" URL. The security check for these
15 +
redirects (namely ``django.utils.http.is_safe_url()``) considered some URLs
16 +
with basic authentication credentials "safe" when they shouldn't be.
17 + 18 +
For example, a URL like ``http://mysite.example.com\@attacker.com`` would be
19 +
considered safe if the request's host is ``http://mysite.example.com``, but
20 +
redirecting to this URL sends the user to ``attacker.com``.
21 + 22 +
Also, if a developer relies on ``is_safe_url()`` to provide safe redirect
23 +
targets and puts such a URL into a link, they could suffer from an XSS attack.
24 + 9 25
Bugfixes
10 26
========
11 27
@@ -92,6 +92,11 @@ def test_is_safe_url(self):
92 92
'javascript:alert("XSS")',
93 93
'\njavascript:alert(x)',
94 94
'\x08//example.com',
95 +
r'http://otherserver\@example.com',
96 +
r'http:\\testserver\@example.com',
97 +
r'http://testserver\me:pass@example.com',
98 +
r'http://testserver\@example.com',
99 +
r'http:\\testserver\confirm\me@example.com',
95 100
'\n'):
96 101
self.assertFalse(http.is_safe_url(bad_url, host='testserver'), "%s should be blocked" % bad_url)
97 102
for good_url in ('/view/?param=http://example.com',
@@ -101,8 +106,15 @@ def test_is_safe_url(self):
101 106
'https://testserver/',
102 107
'HTTPS://testserver/',
103 108
'//testserver/',
109 +
'http://testserver/confirm?email=me@example.com',
104 110
'/url%20with%20spaces/'):
105 111
self.assertTrue(http.is_safe_url(good_url, host='testserver'), "%s should be allowed" % good_url)
112 +
# Valid basic auth credentials are allowed.
113 +
self.assertTrue(http.is_safe_url(r'http://user:pass@testserver/', host='user:pass@testserver'))
114 +
# A path without host is allowed.
115 +
self.assertTrue(http.is_safe_url('/confirm/me@example.com'))
116 +
# Basic auth without host is not allowed.
117 +
self.assertFalse(http.is_safe_url(r'http://testserver\@example.com'))
106 118 107 119
def test_urlsafe_base64_roundtrip(self):
108 120
bytestring = b'foo'
You can’t perform that action at this time.
RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.4